Function at 0x10006df0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x100a0378
call fcn.1000cc70
test al, al
je 0x10007e3a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61144
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61144], 0xa0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61144
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d1e69
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d1e69], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d1e69
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228d], 0xe9
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228e
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228e], 0x8b
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228e
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d228f
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d228f], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d228f
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2290
call esi
lea ecx, [ebp - 0x108]
mov byte [0x4d2290], 0
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x4d2290
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2291
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d2291], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d2291
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d559c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d559c], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d559c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x633f7a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x633f7a], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x633f7a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x634403
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x634403], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x634403
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x63e6c4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x63e6c4], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x63e6c4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d2246
call esi
mov byte [0x4d2246], 0xeb
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 1
push 0x4d2246
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x501163
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x501163], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x501163
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40af0a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40af0a], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40af0a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4bc
call esi
mov bl, 0x50
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4bc], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4bc
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4c5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4c5], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4c5
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40b4cf
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40b4cf], 0x18
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40b4cf
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40af0a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40af0a], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40af0a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x40afd5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x40afd5], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x40afd5
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c8f86
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c8f86], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c8f86
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c8dac
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c8dac], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c8dac
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x777fd6
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x777fd6], 0x70
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x777fd6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x777fd7
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x777fd7], 0x17
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x777fd7
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4ebec7
call esi
mov bl, 0x3c
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4ebec7], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4ebec7
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x5c4004
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x5c4004], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x5c4004
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7e40bb
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7e40bb], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7e40bb
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x81b546
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x81b546], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x81b546
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x81b58d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x81b58d], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x81b58d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e284
call esi
lea ecx, [ebp - 0x108]
mov byte [0x86e284], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x86e284
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e44c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86e44c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86e44c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86e573
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86e573], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86e573
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x86f8fc
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x86f8fc], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x86f8fc
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7da373
call esi
mov bl, 0xb7
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7da373], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7da373
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x7e1c44
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x7e1c44], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x7e1c44
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x52100d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x52100d], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x52100d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x52101b
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x52101b], 2
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x52101b
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x9543c4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x9543c4], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x9543c4
call esi
mov bl, byte [0x100a0524]
lea eax, [ebp - 0x108]
push eax
neg bl
push 0x40
sbb bl, bl
push 1
and bl, 0x8a
push 0x64cbd1
add bl, 0xeb
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x64cbd1], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x64cbd1
call esi
mov bl, byte [0x100a0525]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x64cbd0
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x64cbd0], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x64cbd0
call esi
mov bl, byte [0x100a0525]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x95ceef
call esi
lea ecx, [ebp - 0x108]
mov byte [0x95ceef], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x95ceef
call esi
mov bl, byte [0x100a0525]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x95cf14
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x95cf14], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x95cf14
call esi
mov bl, byte [0x100a03e0]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f68
inc bl
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f68], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f68
call esi
mov bl, byte [0x100a03e2]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f69
add bl, 2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f69], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f69
call esi
mov bl, byte [0x100a03e3]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6a
add bl, 3
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f6a], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f6a
call esi
mov bl, byte [0x100a03e5]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6b
add bl, 4
call esi
lea ecx, [ebp - 0x108]
mov byte [0xe61f6b], bl
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0xe61f6b
call esi
mov bl, byte [0x100a03e6]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0xe61f6c
add bl, 5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0xe61f6c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0xe61f6c
call esi
mov di, word [0x100a03de]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0xe609e4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov word [0xe609e4], di
mov edx, dword [ebp - 0x108]
push edx
push 2
push 0xe609e4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4d0e09
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4d0e09], 0x100a03f9
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4d0e09
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4d9f55
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4d9f55], 0x100a0419
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4d9f55
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xd226c8
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xd226c8], 0x10006d00
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xd226c8
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xd2265c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xd2265c], 0x10006d20
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xd2265c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57f9fd
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57f9fd], 0x130
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57f9fd
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fa40
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fa40], 0x154
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fa40
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fa82
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fa82], 0x178
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fa82
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x57fac4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x57fac4], 0x19c
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x57fac4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x597694
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x597694], 0x200
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x597694
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4289ef
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4289ef], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4289ef
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x1b
push 0xd20170
call esi
mov eax, 0x90909090
mov ecx, 0xd20170
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov word [ecx + 0x18], ax
mov byte [ecx + 0x1a], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x1b
push 0xd20170
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x3f
push 0x5528b6
call esi
push 0x3f
push 0x90
push 0x5528b6
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x3f
push 0x5528b6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x14
push 0x63e908
call esi
mov eax, 0x90909090
mov ecx, 0x63e908
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x14
push 0x63e908
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0xd
push 0x64452a
call esi
mov eax, 0x90909090
mov ecx, 0x64452a
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0xd
push 0x64452a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x792b7f
call esi
mov eax, 0x90909090
mov ecx, 0x792b7f
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x792b7f
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x20
push 0xe611b2
call esi
push 0x20
push 0x100a03bd
push 0xe611b2
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x20
push 0xe611b2
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x11
push 0xe61f70
call esi
mov ecx, dword [0x100a03e8]
mov eax, 0xe61f70
mov dword [eax], ecx
mov edx, dword [0x100a03ec]
mov dword [eax + 4], edx
mov ecx, dword [0x100a03f0]
mov dword [eax + 8], ecx
mov edx, dword [0x100a03f4]
mov dword [eax + 0xc], edx
mov cl, byte [0x100a03f8]
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 0x10], cl
mov eax, dword [ebp - 0x108]
push eax
push 0x11
push 0xe61f70
call esi
push 0x10004b00
push 0x5b96e8
mov bl, 0xe8
call fcn.10011270
push fcn.1000d090
push 0x65fd79
or bl, 0xff
call fcn.10011270
push 0x1012c3d0
mov eax, 0x6b
call fcn.10011340
push 0x1012c2e0
mov eax, 0x6c
call fcn.10011340
push 0x1012ab70
mov eax, 0x6d
call fcn.10011340
add esp, 0x1c
mov eax, 0x100a0720
call fcn.10002670
mov eax, 0x100c7820
call fcn.100026f0
mov eax, 0x100c7e60
call fcn.10002770
mov edx, 0x100e14a0
call fcn.10002840
mov eax, 0x100e1f90
call fcn.10002a50
mov eax, 0x100e6130
call fcn.10002b30
mov eax, 0x100e8020
call fcn.10002b90
mov eax, 0x100e9f10
call fcn.10002bf0
mov eax, 0x100ebe00
call fcn.10002db0
mov edx, 0x10126f50
call fcn.10002e70
push 0
push str.DataEnc1.dat
call fcn.1000b330
push 1
push str.DataDec2.dat
call fcn.1000b330
push 0x100089b0
push 0x7729b3
mov bl, 0xe8
call fcn.10011270
push 0x10008980
push 0x772960
call fcn.10011270
push 0x100088b0
push 0x849180
mov bl, 0xe9
call fcn.10011270
push 0x100088e0
push 0x848e00
call fcn.10011270
call fcn.10001c20
push 0x10001fc0
push 0x78b0bc
call fcn.10011270
push 0x10002090
push 0x789765
call fcn.10011270
push 0x100020c0
push 0x789a61
call fcn.10011270
push 0x100020f0
push 0x789daa
call fcn.10011270
add esp, 0x40
call fcn.10002120
call fcn.10003230
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0xd22578
call esi
lea edx, [ebp - 0x108]
push edx
mov dword [0xd22578], 0x100035a0
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0xd22578
call esi
call fcn.100037b0
push 0x10003ad0
push 0x7c8270
call fcn.10011270
push 0x10004220
push 0x7c7860
call fcn.10011270
add esp, 0x10
call fcn.100048b0
call fcn.10004dd0
cmp byte [0x100a0554], 0
je 0x10007cf0
push 0x10006300
push 0x834682
mov bl, 0xe8
call fcn.10011270
push 0x10006320
push 0x860ae8
call fcn.10011270
add esp, 0x10
call fcn.10004eb0
call fcn.10007e70
call fcn.10008110
call fcn.1000b8c0
call fcn.1000e090
call fcn.1000ec90
push fcn.1000efd0
push 0x5c2170
mov bl, 0xe9
call fcn.10011270
push 0x1000f140
push 0x5c17b0
call fcn.10011270
push 0x1000f420
push 0x58e3b0
call fcn.10011270
push 0x10010000
push 0x7e44d3
or bl, 0xff
call fcn.10011270
add esp, 0x20
call fcn.10004f30
test byte [0x100a039c], 1
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
je 0x10007d80
push 0x100a039d
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10007d80
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [0x100a039c], 2
je 0x10007dc8
push 0x100a03bd
lea ecx, [ebp - 0x104]
push str.MAIN_S6ENG__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10007d78
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x100a0378
call fcn.1000cdc0
push edi
call fcn.1000cee0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x1012a46c]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push ecx
push 0x10006b20
push 2
call edi
mov dword [0x1012aab4], eax
call esi
mov edx, dword [0x1012a46c]
push eax
push edx
push 0x10006c10
push 7
call edi
push 0
push 0
push 0
push 0x10006db0
push 0
push 0
mov dword [0x1012aab0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001239d
mov esp, ebp
pop ebp
ret
push str.Could_not_load_ServerInfo.dat_
call fcn.100114a0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]