Function at 0x101a5f4
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [eax], 0x80004005
lea eax, [ebp - 8]
xor esi, esi
push eax
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 8], esi
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x10198a4
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaab
test byte [eax + 0x1c], 1
je 0x101aaab
push 0x1002de4
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x101aaab
push edi
xor edi, edi
inc edi
cmp dword [ebp - 8], edi
jne 0x10198b3
mov dword [ebx + 0x494], edi
jle 0x101a42e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edi*4]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10198c4
sub eax, esi
sar eax, 1
cmp eax, 2
jb 0x101a468
movzx eax, word [ecx]
cmp ax, 0x2d
je 0x10198ee
cmp ax, 0x2f
jne 0x101a498
lea esi, [ecx + 2]
push 0x10034b4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a88c
push 0x10034a8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a88c
push 0x1002f20
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a8d3
push 0x1002f08
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a8d3
push 0x1002ef4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a8d3
push 0x1002edc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101a8d3
push 0x100349c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10199a5
cmp dword [ebx + 0x49c], eax
jne 0x101a4c8
inc eax
mov dword [ebx + 0x498], eax
mov dword [ebx + 0x494], eax
jmp 0x101a424
push 0x1003490
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10199d5
cmp dword [ebx + 0x498], eax
jne 0x101a4f5
inc eax
mov dword [ebx + 0x494], eax
mov dword [ebx + 0x49c], eax
jmp 0x101a424
push 0x1001b84
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019a81
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a522
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019a32
test dx, dx
je 0x1019a2e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019a32
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019a0c
xor eax, eax
jmp 0x1019a37
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019a79
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019a68
test dx, dx
je 0x1019a64
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019a68
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019a42
xor eax, eax
jmp 0x1019a6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x40], eax
jmp 0x101a424
push 0x1001b7c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019b2a
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a54f
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019ade
test dx, dx
je 0x1019ada
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019ade
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019ab8
xor eax, eax
jmp 0x1019ae3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019b22
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019b14
test dx, dx
je 0x1019b10
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019b14
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019aee
xor eax, eax
jmp 0x1019b19
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x44], eax
jmp 0x101a424
push 0x1001b70
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019bd3
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a57c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019b87
test dx, dx
je 0x1019b83
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019b87
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019b61
xor eax, eax
jmp 0x1019b8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019bcb
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019bbd
test dx, dx
je 0x1019bb9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019bbd
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019b97
xor eax, eax
jmp 0x1019bc2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x54], eax
jmp 0x101a424
push 0x1001b18
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019c7c
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a5a9
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019c30
test dx, dx
je 0x1019c2c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019c30
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019c0a
xor eax, eax
jmp 0x1019c35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019c74
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019c66
test dx, dx
je 0x1019c62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019c66
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019c40
xor eax, eax
jmp 0x1019c6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x58], eax
jmp 0x101a424
push 0x1001b08
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019d25
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a5d6
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019cd9
test dx, dx
je 0x1019cd5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019cd9
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019cb3
xor eax, eax
jmp 0x1019cde
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019d1d
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019d0f
test dx, dx
je 0x1019d0b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019d0f
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019ce9
xor eax, eax
jmp 0x1019d14
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x5c], eax
jmp 0x101a424
push 0x1001af8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019dd1
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a603
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019d82
test dx, dx
je 0x1019d7e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019d82
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019d5c
xor eax, eax
jmp 0x1019d87
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019dc9
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019db8
test dx, dx
je 0x1019db4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019db8
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019d92
xor eax, eax
jmp 0x1019dbd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x60], eax
jmp 0x101a424
push 0x1001ac0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019e4a
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a630
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebx + 0x80], eax
test eax, eax
jne 0x101a424
cmp dword [ebx + 0x44], eax
je 0x1019e21
push _amsg_exit
push 0x72
push eax
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0x16
jmp 0x101a8c3
push reloc.KERNEL32.dll_GlobalHandle
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019e88
xor esi, esi
inc esi
mov dword [ebx + 0x494], esi
call fcn.0100634b
test eax, eax
jne 0x1019e80
cmp dword [ebx + 0x44], eax
je 0x1019e80
push _amsg_exit
push 0xaf
push eax
call fcn.010064b6
mov dword [ebp - 0x18], esi
jmp 0x101a424
push 0x1001b60
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019f31
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a65d
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019ee5
test dx, dx
je 0x1019ee1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019ee5
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019ebf
xor eax, eax
jmp 0x1019eea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019f29
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019f1b
test dx, dx
je 0x1019f17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019f1b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019ef5
xor eax, eax
jmp 0x1019f20
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x48], eax
jmp 0x101a424
push 0x1001b50
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1019fda
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a68a
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019f8e
test dx, dx
je 0x1019f8a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019f8e
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019f68
xor eax, eax
jmp 0x1019f93
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1019fd2
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019fc4
test dx, dx
je 0x1019fc0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019fc4
add eax, 4
add ecx, 4
test dx, dx
jne 0x1019f9e
xor eax, eax
jmp 0x1019fc9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x4c], eax
jmp 0x101a424
push 0x1001acc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a052
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a6b7
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebx + 0x7c], eax
test eax, eax
jg 0x101a424
cmp dword [ebx + 0x44], 0
je 0x101a029
push _amsg_exit
push reloc.KERNEL32.dll_GlobalHandle
push 0
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0x1b
jmp 0x101a8c3
push 0x1001ae4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a0c3
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a6e4
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebx + 0x78], eax
test eax, eax
jne 0x101a424
push _amsg_exit
push 0x73
push eax
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0x1d
jmp 0x101a8c3
push 0x1001a98
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a116
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a711
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
lea eax, [ebx + 0x84]
push 0x104
push eax
call fcn.010066e4
mov esi, eax
test esi, esi
jl 0x101a73e
mov dword [ebx + 0x68], 1
jmp 0x101a424
push 0x1001a84
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a1b2
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a77f
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
lea esi, [ebx + 0x28c]
push 0x104
push esi
call fcn.010066e4
test eax, eax
jl 0x101a7ac
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101a424
mov eax, dword [section..data]
cmp eax, section..data
je 0x101a1a8
test byte [eax + 0x1c], 1
je 0x101a1a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x101a190
mov eax, 0x54f
push eax
mov eax, dword [section..data]
push 0x1002de4
push reloc.USER32.dll_SetWindowPos
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010062be
xor eax, eax
mov word [esi], ax
jmp 0x101a424
push 0x1003474
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a22e
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a7d8
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
lea eax, [ebx + 0x4a0]
push 0x104
push eax
call fcn.010066e4
test eax, eax
jge 0x101a424
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x101aaa1
test byte [ecx + 0x1c], 1
je 0x101aaa1
movzx eax, ax
push eax
push 0x1002de4
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010062be
jmp 0x101aaa1
push 0x1003460
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a2d7
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a805
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a28b
test dx, dx
je 0x101a287
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a28b
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a265
xor eax, eax
jmp 0x101a290
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x101a2cf
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a2c1
test dx, dx
je 0x101a2bd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a2c1
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a29b
xor eax, eax
jmp 0x101a2c6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x6c], eax
jmp 0x101a424
push reloc.KERNEL32.dll_GlobalHandle
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a380
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a832
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a334
test dx, dx
je 0x101a330
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a334
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a30e
xor eax, eax
jmp 0x101a339
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x101a378
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a36a
test dx, dx
je 0x101a366
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a36a
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a344
xor eax, eax
jmp 0x101a36f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x74], eax
jmp 0x101a424
push reloc.msvcrt.dll_wcstoul
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101a898
inc edi
mov dword [ebx + 0x494], 1
cmp edi, dword [ebp - 8]
je 0x101a85f
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + edi*4]
mov ecx, 0x100348c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a3dd
test dx, dx
je 0x101a3d9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a3dd
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a3b7
xor eax, eax
jmp 0x101a3e2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x101a421
mov ecx, 0x1003488
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a413
test dx, dx
je 0x101a40f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a413
add eax, 4
add ecx, 4
test dx, dx
jne 0x101a3ed
xor eax, eax
jmp 0x101a418
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101a88c
inc eax
mov dword [ebx + 0x70], eax
inc edi
cmp edi, dword [ebp - 8]
jl 0x10198b9
cmp dword [ebx + 0x494], 0
jne 0x101a8e5
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x29
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0xb
jmp 0x101a8c3
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0xc
jmp 0x101a8c3
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0xd
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0xe
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0xf
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x10
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x11
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x12
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x13
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x14
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x15
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x17
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x18
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x1a
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x1c
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x1e
jmp 0x101aa5b
cmp dword [ebx + 0x44], 0
je 0x101a74f
push _amsg_exit
push 0x71
push 0
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
movzx ecx, si
push ecx
push 0x1002de4
push TlsFree
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x101a224
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push reloc.KERNEL32.dll_TlsFree
jmp 0x101aa5b
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x101aaa1
test byte [ecx + 0x1c], 1
je 0x101aaa1
movzx eax, ax
push eax
push 0x1002de4
push GdipAlloc
jmp 0x101a21e
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x23
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x25
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x26
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x27
jmp 0x101aa5b
mov ecx, ebx
call fcn.010156a2
jmp 0x101aaa1
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push dword [ebp + 8]
push 0x1002de4
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b7e5
jmp 0x101aaa1
and dword [ebx + 0x494], 0
and dword [ebx + 0x44], 0
mov dword [ebp - 0x14], 1
cmp dword [ebx + 0x54], 0
je 0x101a972
lea edx, [ebx + 0x84]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101a8fa
sub eax, esi
sar eax, 1
je 0x101a972
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov esi, eax
push reloc.USER32.dll_SetParent
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x101a935
push reloc.USER32.dll_SetParent
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x101a972
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x101a96f
push _amsg_exit
push 0xb5
push eax
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x2a
jmp 0x101aa5b
mov dword [ebx + 0x40], eax
lea edi, [ebx + 0x40]
push edi
call fcn.01007248
cmp eax, 0x80070005
jne 0x101a9a8
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x2b
jmp 0x101aa5b
test eax, eax
jge 0x101a9d2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push 0x2c
jmp 0x101aa5b
mov esi, dword [ebx + 0x494]
test esi, esi
je 0x101aa68
cmp dword [ebx + 0x498], 0
je 0x101aa2c
lea eax, [ebx + 0x84]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101a9f2
sub eax, edx
sar eax, 1
jne 0x101aa2c
push _amsg_exit
push 0x71
push 0
call fcn.010064b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push SetParent
jmp 0x101aa5b
cmp dword [ebx + 0x49c], 0
je 0x101aa71
cmp dword [ebp - 8], 2
jle 0x101aa68
mov ecx, ebx
call fcn.010156a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x101aaa1
test byte [eax + 0x1c], 1
je 0x101aaa1
push 0x1002de4
push reloc.USER32.dll_SetParent
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x101aaa1
cmp dword [ebx + 0x49c], 0
jne 0x101aa91
cmp dword [ebp - 0x14], 0
jne 0x101aa91
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
and eax, 0x2710
push eax
push 1
push esi
push edi
call fcn.01006544
test eax, eax
jl 0x101aaa1
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.01019781
mov byte [ebp - 1], al
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 8