Function at 0x1000d430
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x100b9420
call fcn.10013300
test al, al
je 0x1000e4d6
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61144
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61144], 0xa0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61144
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d1e69
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d1e69], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d1e69
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228d], 0xe9
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228e
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228e], 0x8b
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228e
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228f
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228f], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228f
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2290
call esi
lea ecx, [ebp - 0x108]
mov byte [0x4d2290], 0
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x4d2290
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2291
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d2291], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d2291
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d559c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d559c], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d559c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x633f7a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x633f7a], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x633f7a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x634403
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x634403], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x634403
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x63e6c4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x63e6c4], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x63e6c4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2246
call esi
mov byte [0x4d2246], 0xeb
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 1
push 0x4d2246
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x501163
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x501163], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x501163
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40af0a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40af0a], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40af0a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4bc
call esi
mov bl, 0x50
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4bc], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4bc
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4c5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4c5], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4c5
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4cf
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4cf], 0x18
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4cf
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40af0a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40af0a], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40af0a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40afd5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40afd5], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40afd5
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c8f86
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c8f86], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c8f86
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c8dac
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c8dac], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c8dac
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x777fd6
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x777fd6], 0x70
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x777fd6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x777fd7
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x777fd7], 0x17
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x777fd7
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4ebec7
call esi
mov bl, 0x3c
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4ebec7], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4ebec7
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c4004
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c4004], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c4004
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7e40bb
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7e40bb], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7e40bb
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x81b546
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x81b546], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x81b546
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x81b58d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x81b58d], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x81b58d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e284
call esi
lea ecx, [ebp - 0x108]
mov byte [0x86e284], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x86e284
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e44c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86e44c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86e44c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e573
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86e573], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86e573
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86f8fc
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86f8fc], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86f8fc
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7da373
call esi
mov bl, 0xb7
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7da373], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7da373
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7e1c44
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7e1c44], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7e1c44
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x52100d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x52100d], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x52100d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x52101b
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x52101b], 2
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x52101b
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x9543c4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x9543c4], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x9543c4
call esi
mov bl, byte [0x100b95cc]
lea eax, [ebp - 0x108]
push eax
neg bl
push 0x40
sbb bl, bl
push 1
and bl, 0x8a
push 0x64cbd1
add bl, 0xeb
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x64cbd1], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x64cbd1
call esi
mov bl, byte [0x100b95cd]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x64cbd0
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x64cbd0], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x64cbd0
call esi
mov bl, byte [0x100b95cd]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x95ceef
call esi
lea ecx, [ebp - 0x108]
mov byte [0x95ceef], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x95ceef
call esi
mov bl, byte [0x100b95cd]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x95cf14
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x95cf14], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x95cf14
call esi
mov bl, byte [0x100b9488]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f68
inc bl
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f68], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f68
call esi
mov bl, byte [0x100b948a]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f69
add bl, 2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f69], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f69
call esi
mov bl, byte [0x100b948b]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6a
add bl, 3
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f6a], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f6a
call esi
mov bl, byte [0x100b948d]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6b
add bl, 4
call esi
lea ecx, [ebp - 0x108]
mov byte [0xe61f6b], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0xe61f6b
call esi
mov bl, byte [0x100b948e]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6c
add bl, 5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f6c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f6c
call esi
mov di, word [0x100b9486]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0xe609e4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov word [0xe609e4], di
mov edx, dword [ebp - 0x108]
push edx
push 2
push 0xe609e4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4d0e09
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4d0e09], 0x100b94a1
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4d0e09
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4d9f55
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4d9f55], 0x100b94c1
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4d9f55
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xd226c8
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xd226c8], 0x1000d340
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xd226c8
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xd2265c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xd2265c], 0x1000d360
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xd2265c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57f9fd
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57f9fd], 0x130
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57f9fd
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fa40
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fa40], 0x154
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fa40
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fa82
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fa82], 0x178
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fa82
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fac4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fac4], 0x19c
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fac4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x597694
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x597694], 0x200
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x597694
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4289ef
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4289ef], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4289ef
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x1b
push 0xd20170
call esi
mov eax, 0x90909090
mov ecx, 0xd20170
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov word [ecx + 0x18], ax
mov byte [ecx + 0x1a], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x1b
push 0xd20170
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x3f
push 0x5528b6
call esi
push 0x3f
push 0x90
push 0x5528b6
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x3f
push 0x5528b6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x14
push 0x63e908
call esi
mov eax, 0x90909090
mov ecx, 0x63e908
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x14
push 0x63e908
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0xd
push 0x64452a
call esi
mov eax, 0x90909090
mov ecx, 0x64452a
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0xd
push 0x64452a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x792b7f
call esi
mov eax, 0x90909090
mov ecx, 0x792b7f
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x792b7f
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x20
push 0xe611b2
call esi
push 0x20
push 0x100b9465
push 0xe611b2
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x20
push 0xe611b2
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x11
push 0xe61f70
call esi
mov ecx, dword [0x100b9490]
mov eax, 0xe61f70
mov dword [eax], ecx
mov edx, dword [0x100b9494]
mov dword [eax + 4], edx
mov ecx, dword [0x100b9498]
mov dword [eax + 8], ecx
mov edx, dword [0x100b949c]
mov dword [eax + 0xc], edx
mov cl, byte [0x100b94a0]
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 0x10], cl
mov eax, dword [ebp - 0x108]
push eax
push 0x11
push 0xe61f70
call esi
push 0x10009f20
push 0x5b96e8
mov bl, 0xe8
call fcn.10017e50
push fcn.10013720
push 0x65fd79
or bl, 0xff
call fcn.10017e50
push 0x1015e518
mov eax, 0x6b
call fcn.10017f20
push 0x1015e428
mov eax, 0x6c
call fcn.10017f20
push 0x1015ccb8
mov eax, 0x6d
call fcn.10017f20
add esp, 0x1c
mov eax, 0x100b97cc
call fcn.10007710
mov eax, 0x100e08cc
call fcn.10007790
mov eax, 0x100e0f0c
call fcn.100079a0
mov edx, 0x100fa54c
call fcn.10007be0
mov eax, 0x100ff68c
call fcn.10007df0
mov eax, 0x1010382c
call fcn.10008170
mov eax, 0x10109f4c
call fcn.100081d0
mov eax, 0x1011066c
call fcn.10008230
mov eax, 0x10116d8c
call fcn.100083f0
mov edx, 0x10151edc
call fcn.100084b0
mov edx, 0x100fb03c
call fcn.10007ad0
push 0
push str.DataEnc1.dat
call fcn.10011790
push 1
push str.DataDec2.dat
call fcn.10011790
push 0x1000f180
push 0x7729b3
mov bl, 0xe8
call fcn.10017e50
push 0x1000f150
push 0x772960
call fcn.10017e50
push 0x1000f0e0
push 0x849180
mov bl, 0xe9
call fcn.10017e50
push 0x1000f120
push 0x848e00
call fcn.10017e50
call fcn.100040a0
push 0x10004440
push 0x78b0bc
call fcn.10017e50
push 0x10004510
push 0x789765
call fcn.10017e50
push 0x10004540
push 0x789a61
call fcn.10017e50
push 0x10004570
push 0x789daa
call fcn.10017e50
add esp, 0x40
call fcn.10005ac0
call fcn.10008870
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0xd22578
call esi
lea edx, [ebp - 0x108]
push edx
mov dword [0xd22578], 0x10008be0
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0xd22578
call esi
call fcn.10008df0
push 0x10009110
push 0x7c8270
call fcn.10017e50
push 0x10009630
push 0x7c7860
call fcn.10017e50
add esp, 0x10
call fcn.10009cd0
call fcn.1000a620
cmp byte [0x100b95fe], 0
je 0x1000e33a
push 0x1000c940
push 0x834682
mov bl, 0xe8
call fcn.10017e50
push 0x1000c960
push 0x860ae8
call fcn.10017e50
add esp, 0x10
call fcn.1000a730
call fcn.1000e510
call fcn.1000e7b0
call fcn.1000e940
call fcn.10011f50
call fcn.100147a0
call fcn.100153a0
push fcn.100156f0
push 0x5c2170
mov bl, 0xe9
call fcn.10017e50
push 0x10015860
push 0x5c17b0
call fcn.10017e50
push 0x10015b40
push 0x58e3b0
call fcn.10017e50
push 0x10016710
push 0x7e44d3
or bl, 0xff
call fcn.10017e50
add esp, 0x20
call fcn.1000a7b0
call fcn.1000c5b0
test byte [0x100b9444], 1
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
je 0x1000e3d4
push 0x100b9445
xor ebx, ebx
push ebx
push 0x1f0001
call esi
test eax, eax
jne 0x1000e3d6
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
test byte [0x100b9444], 2
je 0x1000e41b
push 0x100b9465
lea ecx, [ebp - 0x104]
push str.MAIN_S6ENG__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push ebx
push 0x1f0001
call esi
test eax, eax
jne 0x1000e3cd
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x100b9420
call fcn.10013450
push edi
call fcn.10013570
call fcn.1000a240
or eax, 0xffffffff
cmp byte [0x100b9600], 1
mov dword [0x1015cc6c], ebx
mov byte [0x1015cc58], bl
mov dword [0x1015cc60], eax
mov dword [0x1015cc68], eax
mov dword [0x1015cc5c], eax
mov dword [0x1015cc74], ebx
mov dword [0x1015cc78], ebx
mov dword [0x1015cc7c], ebx
mov byte [0x1015cc80], bl
jne 0x1000e474
call fcn.10001890
call fcn.10011d30
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x1015cb44]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push ecx
push 0x1000d160
push 2
call edi
mov dword [0x1015cb4c], eax
call esi
mov edx, dword [0x1015cb44]
push eax
push edx
push 0x1000d250
push 7
call edi
push ebx
push ebx
push ebx
push 0x1000d3f0
push ebx
push ebx
mov dword [0x1015cb48], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
push str.Could_not_load_ServerInfo.dat_
call fcn.10018080
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]