Function at 0x100d6a20
Capabilities:
Get file size
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102147b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3b4
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x398], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x39c], eax
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3a4], eax
push esi
lea ecx, [ebp - 0x3a4]
call fcn.10004a70
test al, al
jne 0x100d6adc
test esi, esi
jne 0x100d6ab6
xor ecx, ecx
jmp 0x100d6acf
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x100d6ac0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d6ac0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x3a4]
call fcn.10004050
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3a0], eax
push edi
lea ecx, [ebp - 0x3a0]
call fcn.10004a70
test al, al
jne 0x100d6b32
test edi, edi
jne 0x100d6b11
xor ecx, ecx
jmp 0x100d6b25
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d6b16
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x3a0]
call fcn.10004050
cmp dword [0x1024e320], 0
je 0x100d6b81
mov dword [0x1024e320], 0
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x388], 4
lea eax, [ebp - 0x388]
push eax
push 0x10256c34
lea eax, [ebp - 0x3a8]
push eax
push str.WriteScanLog
push str.SOFTWARE360Safe_antiadware
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [0x10256c34], 1
jne 0x100d7131
push 0x208
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.102134e7
push str.antiadwa_scan.log
push 0x104
lea eax, [ebp - 0x22c]
push eax
push dword [0x10256b30]
call fcn.100e53d0
add esp, 0x1c
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x3a8], edi
cmp edi, 0xffffffff
je 0x100d7131
mov dword [ebp - 0x390], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x100d6c1d
push eax
lea eax, [ebp - 0x390]
push eax
push 2
push 0x10227d4c
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
call fcn.1021360d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.102010c0
add esp, 0xc
test eax, eax
jne 0x100d7d8d
lea eax, [ebp - 0x280]
push eax
push str._Y__m__d__H__M__S
push 0x80
lea eax, [ebp - 0x380]
push eax
call fcn.102136a3
add esp, 0x10
test eax, eax
jne 0x100d6c7d
mov word [ebp - 0x380], ax
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x394]
call fcn.10004700
lea eax, [ebp - 0x394]
push eax
push str._____________________________
lea eax, [ebp - 0x388]
push eax
call fcn.10023460
add esp, 0xc
push eax
lea ecx, [ebp - 0x394]
call fcn.10004870
mov edx, dword [ebp - 0x388]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d6cd6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0x1e
push str.______________________________
lea ecx, [ebp - 0x394]
call fcn.100048e0
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3b4], eax
push str._r_nTitle:
lea ecx, [ebp - 0x3b4]
call fcn.10004a70
test al, al
jne 0x100d6d2b
push 9
push str._r_nTitle:
lea ecx, [ebp - 0x3b4]
call fcn.10004050
mov eax, dword [ebp - 0x3a4]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x3b4]
call fcn.100048e0
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3b0], eax
push str._r_nDescription:
lea ecx, [ebp - 0x3b0]
call fcn.10004a70
test al, al
jne 0x100d6d83
push 0xf
push str._r_nDescription:
lea ecx, [ebp - 0x3b0]
call fcn.10004050
mov eax, dword [ebp - 0x3a0]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x3b0]
call fcn.100048e0
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38c], eax
push 0x2784
lea ecx, [ebp - 0x38c]
call fcn.10004a70
test al, al
jne 0x100d6df1
mov ecx, 0x2784
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d6dd1
sub ecx, edx
sar ecx, 1
push ecx
push 0x2784
lea ecx, [ebp - 0x38c]
call fcn.10004050
mov eax, dword [ebp + 0x24]
cmp eax, 2
jne 0x100d6e00
push 0x2808
jmp 0x100d6e0a
cmp eax, 4
jne 0x100d6e45
push 0x27ae
lea ecx, [ebp - 0x388]
call fcn.10004700
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100048e0
mov edx, dword [ebp - 0x388]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d6e92
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x100d6e92
lea ecx, [ebp - 0x388]
cmp eax, 1
jne 0x100d6e6d
push 0x27c9
call fcn.10004700
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100048e0
jmp 0x100d6e87
push 0x2792
call fcn.10004700
push eax
lea eax, [ebp - 0x38c]
push eax
call fcn.1006cce0
add esp, 8
lea ecx, [ebp - 0x388]
call int.10008f10
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3b8], eax
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x388], eax
push 0x2782
lea ecx, [ebp - 0x388]
call fcn.10004a70
test al, al
jne 0x100d6f10
mov ecx, 0x2782
lea edx, [ecx + 2]
jmp 0x100d6ef0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d6ef0
sub ecx, edx
sar ecx, 1
push ecx
push 0x2782
lea ecx, [ebp - 0x388]
call fcn.10004050
push dword [ebp + 0x40]
mov esi, dword [ebp - 0x388]
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.10004de0
add esp, 0xc
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d6f40
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov eax, dword [ebp - 0x394]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add ecx, ecx
push ecx
push eax
push edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
mov eax, dword [ebp - 0x3b4]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add ecx, ecx
push ecx
push eax
push edi
call esi
mov eax, dword [ebp - 0x3b0]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add ecx, ecx
push ecx
push eax
push edi
call esi
mov eax, dword [ebp - 0x38c]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add ecx, ecx
push ecx
push eax
push edi
call esi
mov edi, dword [ebp - 0x3b8]
mov eax, dword [edi - 0xc]
push 0
lea ecx, [ebp - 0x390]
push ecx
add eax, eax
push eax
push edi
push dword [ebp - 0x3a8]
call esi
mov eax, dword [ebp - 0x3bc]
test eax, eax
je 0x100d7024
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x100d7024
mov edi, dword [ebp - 0x3a8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add eax, eax
push eax
push ecx
push edi
call ebx
push 0
lea eax, [ebp - 0x390]
push eax
push 4
push 0x1021ba40
push edi
call ebx
add esi, 4
mov eax, dword [ebp - 0x3bc]
cmp esi, dword [eax + 4]
jne 0x100d6fe5
mov edi, dword [ebp - 0x3b8]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x39c]
test eax, eax
je 0x100d7080
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x100d7080
mov edi, dword [ebp - 0x3a8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
push 0
lea edx, [ebp - 0x390]
push edx
add eax, eax
push eax
push ecx
push edi
call ebx
push 0
lea eax, [ebp - 0x390]
push eax
push 4
push 0x1021ba40
push edi
call ebx
add esi, 4
mov eax, dword [ebp - 0x39c]
cmp esi, dword [eax + 4]
jne 0x100d7041
mov edi, dword [ebp - 0x3b8]
or ebx, 0xffffffff
push 0
lea eax, [ebp - 0x390]
push eax
push 4
push 0x1021ba40
mov esi, dword [ebp - 0x3a8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100d70bb
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov edx, dword [ebp - 0x38c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d70d8
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp - 0x3b0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d70f5
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp - 0x3b4]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7112
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp - 0x394]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7134
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x100d7134
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x398]
cmp dword [ecx + 4], 0
je 0x100d7ccb
mov esi, dword [ebp - 0x3bc]
test esi, esi
je 0x100d715d
cmp dword [ebp + 0x50], 0
je 0x100d715d
push esi
call fcn.100da0d0
add esp, 4
mov edi, dword [ebp - 0x39c]
test edi, edi
je 0x100d7170
push edi
call fcn.100da0d0
add esp, 4
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 7
xor eax, eax
mov word [ebp - 0x25c], ax
test esi, esi
je 0x100d71dc
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x100d71dc
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d71c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x25c]
call fcn.10008240
test edi, edi
je 0x100d720c
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x100d720c
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d71f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x25c]
call fcn.10007e60
mov esi, dword [ebp - 0x3a4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7217
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x25c]
call fcn.10007e60
mov edi, dword [ebp - 0x3a0]
mov ecx, edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7240
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x25c]
call fcn.10007e60
lea eax, [ebp - 0x25c]
cmp dword [ebp - 0x248], 8
jb 0x100d7271
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x304], ecx
push dword [0x1024e2f0]
push eax
lea ecx, [ebp - 0x304]
call fcn.10028320
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x304]
call fcn.10007850
add esp, 8
lea ecx, [ebp - 0x300]
mov eax, dword [ebp - 0x304]
cmp eax, ecx
je 0x100d72ba
push eax
call fcn.10213559
add esp, 4
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10006e20
add esp, 0xc
mov ecx, eax
mov dword [ebp - 0x388], ecx
lea eax, [ebp - 0x244]
cmp eax, ecx
je 0x100d736b
mov edx, dword [ebp - 0x230]
cmp edx, 0x10
jb 0x100d7325
inc edx
mov ecx, dword [ebp - 0x244]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d7315
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7d97
push edx
push ecx
call fcn.102134ff
add esp, 8
mov ecx, dword [ebp - 0x388]
mov eax, dword [ecx]
mov dword [ebp - 0x244], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x240], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x23c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x238], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x234], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x230], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov edx, dword [ebp - 0x260]
cmp edx, 0x10
jb 0x100d73a5
inc edx
mov ecx, dword [ebp - 0x274]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d739b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7d97
push edx
push ecx
call fcn.102134ff
add esp, 8
mov edx, dword [ebp - 0x248]
cmp edx, 8
jb 0x100d73e5
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x25c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d73db
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7d9c
push edx
push ecx
call fcn.102134ff
add esp, 8
push 0x1025abd4
push 0x80
call fcn.101e27d0
add esp, 8
test eax, eax
je 0x100d7bdb
mov ecx, eax
call fcn.100bfbc0
mov dword [ebp - 0x38c], eax
test eax, eax
je 0x100d7bdb
mov ebx, eax
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x3c0]
test ecx, ecx
je 0x100d7438
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7426
sub ecx, edx
sar ecx, 1
lea eax, [ebx + 0x10]
push ecx
push dword [ebp - 0x3c0]
mov ecx, eax
call fcn.10004050
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebx + 0xc]
call fcn.10004870
lea eax, [ebx + 0x14]
mov ecx, dword [ebp - 0x3ac]
test ecx, ecx
je 0x100d7477
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7465
sub ecx, edx
sar ecx, 1
lea eax, [ebx + 0x14]
push ecx
push dword [ebp - 0x3ac]
mov ecx, eax
call fcn.10004050
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x40], eax
lea ecx, [ebp - 0x3a4]
push ecx
lea ecx, [ebx + 8]
call fcn.10004870
mov eax, dword [ebp + 0x2c]
mov dword [ebx + 0x48], eax
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebx + 0x4c]
call fcn.10004870
lea eax, [ebp + 0x34]
push eax
lea ecx, [ebx + 0x50]
call fcn.10004870
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebx + 0x54]
call fcn.10004870
mov eax, dword [ebp - 0x3bc]
test eax, eax
je 0x100d74eb
lea ecx, [ebx + 0x28]
cmp ecx, eax
je 0x100d74eb
push dword [ebp - 0x3ac]
push dword [eax + 4]
push dword [eax]
call fcn.10020090
mov eax, dword [ebp - 0x39c]
test eax, eax
je 0x100d750c
lea ecx, [ebx + 0x34]
cmp ecx, eax
je 0x100d750c
push dword [ebp - 0x3ac]
push dword [eax + 4]
push dword [eax]
call fcn.10020090
mov eax, dword [ebp + 0x3c]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x40]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x44]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x44], 7
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0x244]
cmp ecx, eax
je 0x100d754d
cmp dword [ebp - 0x230], 0x10
jb 0x100d7541
mov eax, dword [ebp - 0x244]
push dword [ebp - 0x234]
push eax
call fcn.10008140
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x70], eax
push dword [ebp + 0x24]
push ecx
mov ebx, esp
add esi, 0xfffffff0
mov dword [ebp - 0x3ac], esi
push esi
call fcn.10004ba0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
lea ebx, [ebp - 0x244]
cmp dword [ebp - 0x230], 0x10
jb 0x100d7585
mov ebx, dword [ebp - 0x244]
push ecx
push esp
mov ecx, dword [ebp - 0x398]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x28]
push ebx
call fcn.101d0e60
add esp, 0x18
test eax, eax
jne 0x100d76b0
test byte [ebp + 0x4c], 0x80
jne 0x100d75bc
cmp ebx, 0x11170
jb 0x100d76b0
mov edx, dword [ebp - 0x230]
cmp edx, 0x10
jb 0x100d75f6
inc edx
mov ecx, dword [ebp - 0x244]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d75ec
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7db5
push edx
push ecx
call fcn.102134ff
add esp, 8
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
add edi, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100d762b
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d763f
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov edx, dword [ebp + 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7659
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7673
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d768d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x48]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d6d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x100d7d6d
mov ecx, dword [ebp - 0x398]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x100d76c6
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, eax
jmp 0x100d76cb
mov esi, 0x10219d7c
push ecx
mov ebx, esp
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7da1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov ecx, ebx
call fcn.10004a70
test al, al
jne 0x100d7718
test esi, esi
jne 0x100d76fb
xor ecx, ecx
jmp 0x100d770f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7700
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, ebx
call fcn.10004050
lea eax, [ebp - 0x244]
cmp dword [ebp - 0x230], 0x10
jb 0x100d772d
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x384], ecx
push 3
push eax
lea ecx, [ebp - 0x384]
call fcn.10036a60
push dword [ebp + 0x24]
mov esi, dword [ebp - 0x384]
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
xor eax, eax
mov word [edx], ax
mov ecx, esi
lea ebx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d7770
sub ecx, ebx
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.10008240
push dword [ebp + 0x28]
call fcn.101cfe50
add esp, 0x24
lea ecx, [ebp - 0x380]
mov eax, dword [ebp - 0x384]
cmp eax, ecx
je 0x100d77ac
push eax
call fcn.10213559
add esp, 4
push ecx
push esp
mov ebx, dword [ebp - 0x398]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
push ecx
mov esi, esp
mov eax, dword [ebp + 0x48]
add eax, 0xfffffff0
push eax
call fcn.10004ba0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov ebx, dword [ebp - 0x38c]
push ebx
push dword [ebp + 0x28]
call dword [eax + 4]
mov dword [ebp - 0x3c0], eax
mov dword [ebx], eax
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x100d7dab
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x394], eax
push 0x10219d7c
lea ecx, [ebp - 0x394]
call fcn.10004a70
test al, al
jne 0x100d782f
push 0
push 0x10219d7c
lea ecx, [ebp - 0x394]
call fcn.10004050
mov eax, dword [ebx]
cmp eax, 0x11170
jae 0x100d7852
push eax
push 0x1021ba5c
lea eax, [ebp - 0x394]
push eax
call fcn.10004de0
add esp, 0xc
jmp 0x100d78ed
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x304], ecx
push 3
push eax
lea ecx, [ebp - 0x304]
call fcn.10028320
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x304]
call fcn.10007850
add esp, 8
lea ecx, [ebp - 0x300]
mov eax, dword [ebp - 0x304]
cmp eax, ecx
je 0x100d789a
push eax
call fcn.10213559
add esp, 4
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.10006f20
add esp, 0xc
mov edx, eax
cmp dword [edx + 0x14], 8
jb 0x100d78b9
mov edx, dword [edx]
test edx, edx
jne 0x100d78c1
xor ecx, ecx
jmp 0x100d78d5
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d78c6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x394]
call fcn.10004050
lea ecx, [ebp - 0x274]
call fcn.1001d6d0
mov esi, dword [ebp - 0x394]
push esi
push str.UniqueIdentifier
push dword [ebx]
mov ecx, dword [ebp - 0x398]
call fcn.100dac00
add esi, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d7920
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov eax, dword [ebp - 0x398]
lea esi, [eax + 0x3c]
cmp dword [eax + 0x84], 0
je 0x100d797d
test esi, esi
je 0x100d7943
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x398]
lea ecx, [eax + 0x14]
mov edx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
je 0x100d795c
mov eax, dword [ebp - 0x38c]
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x100d7969
lea eax, [ebp - 0x38c]
push eax
push edx
call fcn.100d5b90
test esi, esi
je 0x100d7a3b
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x100d7a3b
test esi, esi
je 0x100d798e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x398]
lea ecx, [eax + 8]
mov edx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
je 0x100d79a7
mov eax, dword [ebp - 0x38c]
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x100d79b4
lea eax, [ebp - 0x38c]
push eax
push edx
call fcn.100d5b90
test esi, esi
je 0x100d79bf
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0
push 0x10219d7c
lea ecx, [ebp - 0x39c]
call fcn.10004700
mov esi, dword [ebp - 0x398]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
sar eax, 2
dec eax
push eax
push 0x1021ba5c
lea eax, [ebp - 0x39c]
push eax
call fcn.10004de0
add esp, 0xc
mov eax, dword [esi + 0x58]
mov esi, dword [ebp - 0x39c]
test eax, eax
je 0x100d7a14
push 0
push 0
push esi
push str.AddEntryItem
call eax
mov ecx, dword [ebp - 0x398]
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x100d7a30
push 0
push 0
push esi
push str.AddEntryItem
push dword [ecx + 0x60]
call eax
lea ecx, [ebp - 0x39c]
call int.10008f10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x230]
cmp edx, 0x10
jb 0x100d7a7c
inc edx
mov ecx, dword [ebp - 0x244]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d7a72
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7db5
push edx
push ecx
call fcn.102134ff
add esp, 8
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100d7aae
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, ebx
mov edx, dword [ebp - 0x3ac]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7ac8
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7ae2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7afc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7b16
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [ebp + 0x48]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x100d7b2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x3c0]
jmp 0x100d7d6f
mov edx, dword [ebp - 0x230]
cmp edx, 0x10
jb 0x100d7c15
inc edx
mov ecx, dword [ebp - 0x244]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d7c0b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d7db5
push edx
push ecx
call fcn.102134ff
add esp, 8
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100d7c47
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d7c5e
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov edx, dword [ebp + 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7c78
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7c92
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7cac
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x100d7cc4
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
xor eax, eax
jmp 0x100d7d6f
mov edx, dword [ebp - 0x3a0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7ce8
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp - 0x3a4]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d05
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d1f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d39
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp + 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d53
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov esi, dword [ebp + 0x48]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d7d6d
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x4c
push 0x80070057
call fcn.100030c0
call fcn.10200ab0
call fcn.10200ab0
push 0x80004005
call fcn.100030c0
push 0x80004005
call fcn.100030c0
call fcn.10200ab0
int3