Function at 0x1005c2f7
Capabilities:
Contain obfuscated stackstrings
Enumerate gui resources
Enumerate process modules
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100bfdd4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1164
call fcn.1008a5c0
mov eax, dword [0x100ea3e0]
xor eax, esp
mov dword [esp + 0x1160], eax
push ebx
push esi
push edi
mov eax, dword [0x100ea3e0]
xor eax, esp
push eax
lea eax, [esp + 0x1178]
mov dword fs:[0], eax
xor ebx, ebx
push 0x100d4e34
mov ecx, 0x1010698c
mov dword [0x1010658c], ebx
call fcn.10003ea0
mov edi, 0xeb
lea eax, [edi + 0x11]
lea edx, [edi - 0x34]
lea ecx, [edi - 0xa]
lea esi, [edi - 0x52]
mov word [esp + 0x990], 0xef
mov word [esp + 0x992], 0xf4
mov word [esp + 0x994], 0xee
mov word [esp + 0x996], 0xf8
mov word [esp + 0x998], di
mov word [esp + 0x99a], ax
mov word [esp + 0x99c], 0xed
mov word [esp + 0x99e], di
mov word [esp + 0x9a0], 0xf8
mov word [esp + 0x9a2], 0xe0
mov word [esp + 0x9a4], dx
mov word [esp + 0x9a6], ax
mov word [esp + 0x9a8], cx
mov word [esp + 0x9aa], ax
mov word [esp + 0x9ac], si
mov word [esp + 0x970], 0xcd
mov word [esp + 0x972], ax
mov word [esp + 0x974], 0xf8
mov word [esp + 0x976], 0xf4
mov word [esp + 0x978], 0xcf
mov word [esp + 0x97a], 0xf0
mov word [esp + 0x97c], ax
mov word [esp + 0x97e], 0xee
mov word [esp + 0x980], ax
mov word [esp + 0x982], di
mov word [esp + 0x984], dx
mov word [esp + 0x986], ax
mov word [esp + 0x988], cx
mov word [esp + 0x98a], ax
mov word [esp + 0x98c], si
mov word [esp + 0x950], 0xc9
mov word [esp + 0x952], 0xda
mov word [esp + 0x954], 0xd8
mov word [esp + 0x956], 0xf7
mov word [esp + 0x958], 0xe0
mov word [esp + 0x95a], 0xce
mov word [esp + 0x95c], 0xf1
mov word [esp + 0x95e], ax
mov word [esp + 0x960], di
mov word [esp + 0x962], ax
mov word [esp + 0x964], dx
mov word [esp + 0x966], ax
mov word [esp + 0x968], cx
mov word [esp + 0x96a], ax
mov word [esp + 0x96c], si
mov word [esp + 0x898], 0xe9
mov word [esp + 0x89a], di
mov word [esp + 0x89c], 0xf6
mov word [esp + 0x89e], 0xfa
mov word [esp + 0x8a0], 0xf4
mov word [esp + 0x8a2], 0xf6
mov word [esp + 0x8a4], 0xf7
mov word [esp + 0x8a6], dx
mov word [esp + 0x8a8], ax
mov word [esp + 0x8aa], cx
mov word [esp + 0x8ac], ax
mov word [esp + 0x8ae], si
mov word [esp + 0x918], 0xe9
mov word [esp + 0x91a], di
mov word [esp + 0x91c], 0xf6
mov word [esp + 0x91e], 0xfa
mov word [esp + 0x920], 0xf4
mov word [esp + 0x922], 0xf6
mov word [esp + 0x924], 0xf7
mov word [esp + 0x926], 0xaf
mov word [esp + 0x928], 0xad
mov word [esp + 0x92a], dx
mov word [esp + 0x92c], ax
mov word [esp + 0x92e], cx
mov word [esp + 0x930], ax
mov word [esp + 0x932], si
mov word [esp + 0x850], 0xc9
mov word [esp + 0x852], di
mov word [esp + 0x854], 0xf6
mov word [esp + 0x856], 0xfa
mov word [esp + 0x858], 0xdc
mov word [esp + 0x85a], cx
mov word [esp + 0x85c], 0xe9
mov word [esp + 0x85e], dx
mov word [esp + 0x860], ax
mov word [esp + 0x862], cx
mov word [esp + 0x864], ax
mov word [esp + 0x866], si
mov word [esp + 0x934], 0xc9
mov word [esp + 0x936], di
mov word [esp + 0x938], 0xf6
mov word [esp + 0x93a], 0xfa
mov word [esp + 0x93c], 0xdc
mov word [esp + 0x93e], cx
mov word [esp + 0x940], 0xe9
mov word [esp + 0x942], 0xaf
mov word [esp + 0x944], 0xad
mov word [esp + 0x946], dx
mov word [esp + 0x948], ax
mov word [esp + 0x94a], cx
mov word [esp + 0x94c], ax
mov word [esp + 0x94e], si
mov word [esp + 0x7f4], 0xc1
mov word [esp + 0x7f6], 0xec
mov word [esp + 0x7f8], ax
mov word [esp + 0x7fa], 0xed
mov word [esp + 0x7fc], di
mov word [esp + 0x7fe], dx
mov word [esp + 0x800], ax
mov word [esp + 0x802], cx
mov word [esp + 0x804], ax
mov word [esp + 0x806], si
mov word [esp + 0x8e0], 0xc9
mov word [esp + 0x8e2], 0xda
mov word [esp + 0x8e4], 0xd1
mov word [esp + 0x8e6], 0xec
mov word [esp + 0x8e8], 0xf7
mov word [esp + 0x8ea], 0xed
mov word [esp + 0x8ec], ax
mov word [esp + 0x8ee], di
mov word [esp + 0x8f0], dx
mov word [esp + 0x8f2], ax
mov word [esp + 0x8f4], cx
mov word [esp + 0x8f6], ax
mov word [esp + 0x8f8], si
mov word [esp + 0x9b0], 0xc9
mov word [esp + 0x9b2], 0xda
mov word [esp + 0x9b4], 0xd1
mov word [esp + 0x9b6], 0xec
mov word [esp + 0x9b8], 0xf7
mov word [esp + 0x9ba], 0xed
mov word [esp + 0x9bc], ax
mov word [esp + 0x9be], di
mov word [esp + 0x9c0], 0xaf
mov word [esp + 0x9c2], 0xad
mov word [esp + 0x9c4], dx
mov word [esp + 0x9c6], ax
mov word [esp + 0x9c8], cx
mov word [esp + 0x9ca], ax
mov word [esp + 0x9cc], si
mov word [esp + 0x868], 0xd6
mov word [esp + 0x86a], 0xf5
mov word [esp + 0x86c], 0xf5
mov word [esp + 0x86e], 0xe0
mov word [esp + 0x870], 0xdd
mov word [esp + 0x872], 0xfb
mov word [esp + 0x874], 0xfe
mov word [esp + 0x876], dx
mov word [esp + 0x878], ax
mov word [esp + 0x87a], cx
mov word [esp + 0x87c], ax
mov word [esp + 0x87e], si
mov word [esp + 0x8fc], 0xef
mov word [esp + 0x8fe], 0xf7
mov word [esp + 0x900], 0xfa
mov word [esp + 0x902], 0xef
mov word [esp + 0x904], 0xf0
push 0x73
mov word [esp + 0x910], di
mov word [esp + 0xa0a], di
mov word [esp + 0xa32], di
pop edi
push 0x65
mov word [esp + 0x916], cx
mov word [esp + 0x7de], cx
mov word [esp + 0x8c6], cx
mov word [esp + 0xa0e], cx
mov word [esp + 0xa18], cx
mov word [esp + 0xa36], cx
mov word [esp + 0xa40], cx
pop ecx
mov word [esp + 0x906], ax
mov word [esp + 0x908], 0xee
mov word [esp + 0x90a], ax
mov word [esp + 0x90e], dx
mov word [esp + 0x910], ax
mov word [esp + 0x914], ax
mov word [esp + 0x916], si
mov word [esp + 0x7cc], 0xf4
mov word [esp + 0x7ce], 0xea
mov word [esp + 0x7d0], 0xed
mov word [esp + 0x7d2], 0xea
mov word [esp + 0x7d4], 0xfa
mov word [esp + 0x7d6], dx
mov word [esp + 0x7d8], ax
mov word [esp + 0x7dc], ax
mov word [esp + 0x7de], si
mov word [esp + 0x8b0], 0xfd
mov word [esp + 0x8b2], ax
mov word [esp + 0x8b4], 0xff
mov word [esp + 0x8b6], 0xf8
mov word [esp + 0x8b8], 0xec
mov word [esp + 0x8ba], 0xf5
mov word [esp + 0x8bc], 0xed
mov word [esp + 0x8be], dx
mov word [esp + 0x8c0], ax
mov word [esp + 0x8c4], ax
mov word [esp + 0x8c6], si
mov word [esp + 0x9f4], 0xf8
mov word [esp + 0x9f6], 0xe9
mov word [esp + 0x9f8], 0xf0
mov word [esp + 0x9fa], 0xf4
mov word [esp + 0x9fc], 0xf6
mov word [esp + 0x9fe], 0xf7
mov word [esp + 0xa00], 0xf0
mov word [esp + 0xa02], 0xed
mov word [esp + 0xa04], 0xf6
mov word [esp + 0xa08], 0xb4
mov word [esp + 0xa0c], 0xa1
mov word [esp + 0xa0e], 0xaf
mov word [esp + 0xa10], dx
mov word [esp + 0xa12], ax
mov word [esp + 0xa16], ax
mov word [esp + 0xa18], si
mov word [esp + 0xa1c], 0xf8
mov word [esp + 0xa1e], 0xe9
mov word [esp + 0xa20], 0xf0
mov word [esp + 0xa22], 0xf4
mov word [esp + 0xa24], 0xf6
mov word [esp + 0xa26], 0xf7
mov word [esp + 0xa28], 0xf0
mov word [esp + 0xa2a], 0xed
mov word [esp + 0xa2c], 0xf6
mov word [esp + 0xa30], 0xb4
mov word [esp + 0xa34], 0xaf
mov word [esp + 0xa36], 0xad
mov word [esp + 0xa38], dx
mov word [esp + 0xa3a], ax
mov word [esp + 0xa3e], ax
mov word [esp + 0xa40], si
mov word [esp + 0xa44], 0x53
mov word [esp + 0xa46], 0x79
mov word [esp + 0xa48], di
mov word [esp + 0xa4a], 0x69
mov word [esp + 0xa4c], 0x6e
mov word [esp + 0xa4e], 0x74
mov word [esp + 0xa50], cx
push 0x72
pop eax
push 0x6f
pop edx
mov word [esp + 0xa52], ax
mov word [esp + 0xa54], 0x6e
mov word [esp + 0xa56], 0x61
mov word [esp + 0xa58], 0x6c
mov word [esp + 0xa5a], di
mov word [esp + 0xa5c], 0x20
mov word [esp + 0xa5e], 0x50
mov word [esp + 0xa60], ax
mov word [esp + 0xa62], dx
mov word [esp + 0xa64], 0x63
mov word [esp + 0xa66], cx
mov word [esp + 0xa68], di
mov word [esp + 0xa6a], di
mov word [esp + 0xa6c], 0x20
mov word [esp + 0xa6e], 0x45
mov word [esp + 0xa70], 0x78
mov word [esp + 0xa72], 0x70
mov word [esp + 0xa74], 0x6c
mov word [esp + 0xa76], dx
mov word [esp + 0xa78], ax
mov word [esp + 0xa7a], cx
mov word [esp + 0xa7c], ax
mov word [esp + 0xa7e], bx
mov word [esp + 0x9d0], 0x50
mov word [esp + 0x9d2], ax
mov word [esp + 0x9d4], dx
mov word [esp + 0x9d6], 0x63
mov word [esp + 0x9d8], cx
mov word [esp + 0x9da], di
mov word [esp + 0x9dc], di
mov word [esp + 0x9de], di
mov word [esp + 0x9e0], 0x20
mov word [esp + 0x9e2], 0x4d
mov word [esp + 0x9e4], dx
mov word [esp + 0x9e6], 0x6e
mov word [esp + 0x9e8], 0x69
mov word [esp + 0x9ea], 0x74
mov word [esp + 0x9ec], dx
mov word [esp + 0x9ee], ax
mov word [esp + 0x9f0], bx
mov word [esp + 0xac0], 0x57
mov word [esp + 0xac2], 0x69
mov word [esp + 0xac4], 0x6e
mov word [esp + 0xac6], 0x44
mov word [esp + 0xac8], dx
mov word [esp + 0xaca], 0x77
mov word [esp + 0xacc], di
mov word [esp + 0xace], 0x20
mov word [esp + 0xad0], 0x47
mov word [esp + 0xad2], 0x55
mov word [esp + 0xad4], 0x49
mov word [esp + 0xad6], 0x20
mov word [esp + 0xad8], di
mov word [esp + 0xada], 0x79
mov word [esp + 0xadc], 0x6d
mov word [esp + 0xade], 0x62
mov word [esp + 0xae0], dx
mov word [esp + 0xae2], 0x6c
mov word [esp + 0xae4], 0x69
mov word [esp + 0xae6], 0x63
mov word [esp + 0xae8], 0x20
mov word [esp + 0xaea], 0x64
mov word [esp + 0xaec], cx
mov word [esp + 0xaee], 0x62
mov word [esp + 0xaf0], 0x75
mov word [esp + 0xaf2], 0x67
mov word [esp + 0xaf4], 0x67
mov word [esp + 0xaf6], cx
mov word [esp + 0xaf8], ax
mov word [esp + 0xafa], bx
mov word [esp + 0xa80], 0x46
mov word [esp + 0xa82], ax
mov word [esp + 0xa84], cx
mov word [esp + 0xa86], cx
mov word [esp + 0xa88], 0x20
mov word [esp + 0xa8a], 0x33
mov word [esp + 0xa8c], 0x32
mov word [esp + 0xa8e], 0x2d
mov word [esp + 0xa90], 0x62
mov word [esp + 0xa92], 0x69
mov word [esp + 0xa94], 0x74
mov word [esp + 0xa96], 0x20
mov word [esp + 0xa98], 0x41
mov word [esp + 0xa9a], 0x6e
mov word [esp + 0xa9c], 0x61
mov word [esp + 0xa9e], 0x6c
mov word [esp + 0xaa0], 0x79
mov word [esp + 0xaa2], di
mov word [esp + 0xaa4], 0x69
mov word [esp + 0xaa6], 0x6e
mov word [esp + 0xaa8], 0x67
mov word [esp + 0xaaa], 0x20
mov word [esp + 0xaac], 0x44
mov word [esp + 0xaae], cx
mov word [esp + 0xab0], 0x62
mov word [esp + 0xab2], 0x75
mov word [esp + 0xab4], 0x67
mov word [esp + 0xab6], 0x67
mov word [esp + 0xab8], cx
mov word [esp + 0xaba], ax
mov word [esp + 0xabc], bx
mov word [esp + 0x820], 0x56
mov word [esp + 0x822], 0x4e
mov word [esp + 0x824], 0x43
mov word [esp + 0x826], 0x20
mov word [esp + 0x828], 0x56
mov word [esp + 0x82a], 0x69
mov word [esp + 0x82c], cx
mov word [esp + 0x82e], 0x77
mov word [esp + 0x830], cx
mov word [esp + 0x832], ax
mov word [esp + 0x834], bx
mov word [esp + 0x790], 0x44
mov word [esp + 0x792], cx
mov word [esp + 0x794], 0x66
mov word [esp + 0x796], cx
mov word [esp + 0x798], 0x6e
mov word [esp + 0x79a], 0x64
mov word [esp + 0x79c], cx
mov word [esp + 0x79e], ax
mov word [esp + 0x7a0], bx
mov word [esp + 0x7a4], 0x49
mov word [esp + 0x7a6], 0x63
mov word [esp + 0x7a8], cx
mov word [esp + 0x7aa], di
mov word [esp + 0x7ac], 0x77
mov word [esp + 0x7ae], dx
mov word [esp + 0x7b0], ax
mov word [esp + 0x7b2], 0x64
mov word [esp + 0x7b4], bx
mov word [esp + 0x8c8], 0x41
mov word [esp + 0x8ca], 0x50
mov word [esp + 0x8cc], 0x49
mov word [esp + 0x8ce], 0x20
mov word [esp + 0x8d0], 0x4d
mov word [esp + 0x8d2], dx
mov word [esp + 0x8d4], 0x6e
mov word [esp + 0x8d6], 0x69
mov word [esp + 0x8d8], 0x74
mov word [esp + 0x8da], dx
mov word [esp + 0x8dc], ax
mov word [esp + 0x8de], bx
mov word [esp + 0x770], 0x56
mov word [esp + 0x772], 0x4d
mov word [esp + 0x774], 0x57
mov word [esp + 0x776], 0x61
mov word [esp + 0x778], ax
mov word [esp + 0x77a], cx
mov word [esp + 0x77c], bx
mov word [esp + 0x838], 0x56
mov word [esp + 0x83a], 0x69
mov word [esp + 0x83c], ax
mov word [esp + 0x83e], 0x74
mov word [esp + 0x840], 0x75
mov word [esp + 0x842], 0x61
mov word [esp + 0x844], 0x6c
mov word [esp + 0x846], 0x62
mov word [esp + 0x848], dx
mov word [esp + 0x84a], 0x78
lea edi, [esp + 0x970]
mov dword [esp + 0x4c], edi
lea edi, [esp + 0x950]
mov dword [esp + 0x50], edi
lea edi, [esp + 0x898]
mov dword [esp + 0x54], edi
lea edi, [esp + 0x918]
mov dword [esp + 0x58], edi
lea edi, [esp + 0x850]
mov dword [esp + 0x5c], edi
lea edi, [esp + 0x934]
mov dword [esp + 0x60], edi
lea edi, [esp + 0x7f4]
mov dword [esp + 0x64], edi
lea edi, [esp + 0x8e0]
mov dword [esp + 0x68], edi
lea edi, [esp + 0x9b0]
mov dword [esp + 0x6c], edi
lea edi, [esp + 0x990]
mov dword [esp + 0x70], edi
lea edi, [esp + 0x868]
mov dword [esp + 0x74], edi
lea edi, [esp + 0x8fc]
mov dword [esp + 0x78], edi
lea edi, [esp + 0x7cc]
mov dword [esp + 0x7c], edi
lea edi, [esp + 0x9f4]
mov dword [esp + 0x80], edi
lea edi, [esp + 0xa1c]
mov dword [esp + 0x84], edi
lea edi, [esp + 0x8b0]
mov dword [esp + 0x88], edi
lea edi, [esp + 0xa44]
mov dword [esp + 0x90], edi
lea edi, [esp + 0x9d0]
mov dword [esp + 0x94], edi
lea edi, [esp + 0xac0]
mov dword [esp + 0x98], edi
lea edi, [esp + 0xa80]
mov dword [esp + 0x9c], edi
lea edi, [esp + 0x820]
mov dword [esp + 0xa0], edi
lea edi, [esp + 0x790]
mov dword [esp + 0xa4], edi
lea edi, [esp + 0x7a4]
mov dword [esp + 0xa8], edi
lea edi, [esp + 0x8c8]
mov dword [esp + 0xac], edi
lea edi, [esp + 0x770]
mov dword [esp + 0x40], edi
lea edi, [esp + 0x838]
mov dword [esp + 0x44], edi
lea edi, [esp + 0x7e0]
mov word [esp + 0x84c], bx
mov word [esp + 0x7e0], 0x56
mov word [esp + 0x7e2], 0x69
mov word [esp + 0x7e4], ax
mov word [esp + 0x7e6], 0x74
mov word [esp + 0x7e8], 0x75
mov word [esp + 0x7ea], 0x61
mov word [esp + 0x7ec], 0x6c
mov word [esp + 0x7ee], 0x70
mov word [esp + 0x7f0], 0x63
mov word [esp + 0x7f2], bx
mov dword [esp + 0x48], edi
mov word [esp + 0x758], 0x6587
mov word [esp + 0x75a], 0x4ef6
mov word [esp + 0x75c], 0x76d1
mov word [esp + 0x75e], 0x63a7
mov word [esp + 0x760], bx
mov word [esp + 0x74c], 0x64cd
mov word [esp + 0x74e], 0x4f5c
mov word [esp + 0x750], 0x76d1
mov word [esp + 0x752], 0x63a7
mov word [esp + 0x754], bx
mov word [esp + 0x744], 0x55c5
mov word [esp + 0x746], 0x63a2
mov word [esp + 0x748], bx
mov word [esp + 0x780], 0x56
mov word [esp + 0x782], 0x69
mov word [esp + 0x784], ax
mov word [esp + 0x80c], ax
mov word [esp + 0x894], ax
mov word [esp + 0x7c6], ax
lea eax, [esp + 0x758]
mov dword [esp + 0xb0], eax
lea eax, [esp + 0x74c]
mov dword [esp + 0xb4], eax
lea eax, [esp + 0x744]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x780]
mov dword [esp + 0xbc], eax
lea eax, [esp + 0x808]
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x880]
mov dword [esp + 0xc4], eax
lea eax, [esp + 0x7b8]
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x764]
mov dword [esp + 0xcc], eax
lea eax, [esp + 0x3c]
push eax
push 0x100d792c
mov word [esp + 0x78e], 0x53
mov word [esp + 0x790], 0x43
mov word [esp + 0x792], 0x41
mov word [esp + 0x794], 0x4e
mov word [esp + 0x796], bx
mov word [esp + 0x810], 0x56
mov word [esp + 0x812], 0x69
mov word [esp + 0x816], 0x75
mov word [esp + 0x818], 0x73
mov word [esp + 0x81a], 0x54
mov word [esp + 0x81c], dx
mov word [esp + 0x81e], 0x74
mov word [esp + 0x820], 0x61
mov word [esp + 0x822], 0x6c
mov word [esp + 0x824], bx
mov word [esp + 0x888], 0x41
mov word [esp + 0x88a], 0x50
mov word [esp + 0x88c], 0x49
mov word [esp + 0x88e], 0x20
mov word [esp + 0x890], 0x4d
mov word [esp + 0x892], dx
mov word [esp + 0x894], 0x6e
mov word [esp + 0x896], 0x69
mov word [esp + 0x898], 0x74
mov word [esp + 0x89a], dx
mov word [esp + 0x89e], bx
mov word [esp + 0x7c0], 0x44
mov word [esp + 0x7c2], cx
mov word [esp + 0x7c4], 0x66
mov word [esp + 0x7c6], cx
mov word [esp + 0x7c8], 0x6e
mov word [esp + 0x7ca], 0x64
mov word [esp + 0x7cc], cx
mov word [esp + 0x7d0], bx
mov word [esp + 0x76c], 0x4efb
mov word [esp + 0x76e], 0x52a1
mov word [esp + 0x770], 0x7ba1
mov word [esp + 0x772], 0x7406
mov word [esp + 0x774], 0x5668
mov word [esp + 0x776], bx
mov dword [esp + 0x44], ebx
call fcn.1005ba6e
lea eax, [esp + 0x40]
push eax
push 0x100d798c
mov dword [esp + 0x48], ebx
call fcn.1005ba6e
add esp, 0x10
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x4c]
jmp 0x1005d5b3
inc eax
inc eax
xor word [eax], si
movzx edx, word [eax]
cmp dx, bx
jne 0x1005d5b1
inc ecx
cmp ecx, 0x10
jb 0x1005d5ab
xor eax, eax
mov dword [esp + 0xd0], ebx
lea edi, [esp + 0xd4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push ebx
push 2
mov dword [esp + 0x2c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
or dword [esp + 0x2c], 0xffffffff
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x34], edi
je 0x1005d705
cmp edi, ebx
je 0x1005d705
mov esi, 0x22c
push esi
lea eax, [esp + 0xf0]
push ebx
push eax
call fcn.10073a50
add esp, 0xc
lea eax, [esp + 0xec]
push eax
push edi
mov dword [esp + 0xf4], esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1005d6fd
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
cmp esi, ebx
je 0x1005d6ef
push 0x206
lea eax, [esp + 0xb4a]
push ebx
push eax
mov word [esp + 0xb50], bx
call fcn.10073a50
add esp, 0xc
push 0x103
lea eax, [esp + 0xb48]
push esi
push eax
call fcn.100740c3
add esp, 0xc
lea eax, [esp + 0xb44]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x40
lea eax, [esp + 0xb02]
push ebx
push eax
mov word [esp + 0xb08], bx
call fcn.10073a50
lea eax, [esp + 0xb50]
add esp, 0xc
push eax
call fcn.10070dbb
pop ecx
push eax
lea esi, [esp + 0xb00]
lea ecx, [esp + 0xb48]
call fcn.10047dbe
test al, al
pop ecx
je 0x1005d6ef
push str.86a1f18a40ba3c1966bb6ce448789b0f
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1005d739
lea eax, [esp + 0xec]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, ebx
jne 0x1005d641
mov dword [esp + 0x30], 0xa
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
push dword [esp + eax*4 + 0xb0]
lea ecx, [esp + 0x14]
call fcn.10003e0b
mov dword [esp + 0x1180], ebx
mov eax, dword [0x1010647c]
cmp eax, ebx
jne 0x1005d762
xor esi, esi
jmp 0x1005d76d
xor eax, eax
inc eax
or dword [0x1010658c], eax
mov dword [0x10106260], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xafc]
push eax
mov ecx, 0x1010698c
call fcn.10003ea0
jmp 0x1005dc32
mov esi, dword [0x10106484]
sub esi, eax
sar esi, 2
call fcn.1005dcb7
cmp eax, esi
jae 0x1005d792
mov ebx, dword [0x10106480]
lea eax, [esp + 0x10]
xor esi, esi
push eax
inc esi
call fcn.1005dd59
mov dword [0x10106480], eax
xor ebx, ebx
jmp 0x1005d7bb
mov esi, dword [0x10106480]
lea edi, [esp + 0x1c]
call fcn.1005df99
push dword [esp + 0x20]
lea eax, [esp + 0x14]
push dword [esp + 0x20]
push eax
lea eax, [esp + 0xf0]
push eax
call fcn.1005dccf
or dword [esp + 0x1180], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10003e76
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 8
jb 0x1005d711
lea eax, [esp + 0x30]
push eax
push 0x1005c116
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x30], 0x64
jne 0x1005d7fe
or dword [0x1010658c], 2
jmp 0x1005dc2a
cmp dword [esp + 0x24], 0xffffffff
je 0x1005dadd
cmp dword [esp + 0x24], ebx
je 0x1005dadd
mov esi, 0x22c
push esi
lea eax, [esp + 0xf0]
push ebx
push eax
call fcn.10073a50
add esp, 0xc
lea eax, [esp + 0xec]
push eax
push dword [esp + 0x28]
mov dword [esp + 0xf4], esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x1005dadd
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
cmp esi, ebx
je 0x1005dac4
push 0x206
lea eax, [esp + 0xb4a]
push ebx
push eax
mov word [esp + 0xb50], bx
call fcn.10073a50
add esp, 0xc
mov edi, 0x103
push edi
lea eax, [esp + 0xb48]
push esi
push eax
call fcn.100740c3
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
add esp, 0xc
lea eax, [esp + 0xb44]
push eax
call esi
push str.QQ.exe
lea eax, [esp + 0xb48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005d8db
cmp dword [esp + 0x28], 5
jae 0x1005d8db
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xf4]
inc dword [esp + 0x28]
mov dword [esp + ecx*4 + 0xd0], eax
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
push dword [esp + eax*4 + 0x4c]
lea eax, [esp + 0xb48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1005db28
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x10
jb 0x1005d8df
mov dword [esp + 0x1c], ebx
push 0x206
lea eax, [esp + 0xd52]
push ebx
push eax
mov word [esp + 0xd58], bx
call fcn.10073a50
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push dword [esp + eax*4 + 0x44]
lea eax, [esp + 0xd54]
push eax
call fcn.100740c3
add esp, 0xc
lea eax, [esp + 0xd4c]
push eax
call esi
lea eax, [esp + 0xd4c]
push eax
lea eax, [esp + 0xb48]
push eax
call fcn.10009e59
test eax, eax
pop ecx
pop ecx
jne 0x1005db28
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jb 0x1005d90c
mov esi, 0x208
push esi
lea eax, [esp + 0xd52]
push ebx
push eax
mov word [esp + 0xd58], bx
call fcn.10073a50
add esp, 0xc
push esi
lea eax, [esp + 0xf62]
push ebx
push eax
mov word [esp + 0xf68], bx
call fcn.10073a50
add esp, 0xc
cmp dword [esp + 0xf4], ebx
je 0x1005dac4
cmp dword [esp + 0xf4], 4
je 0x1005dac4
push dword [esp + 0xf4]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x1005dac4
push 0x104
lea eax, [esp + 0xf60]
push eax
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xd4c]
push eax
lea ecx, [esp + 0xf60]
call fcn.1005bacf
test eax, eax
pop ecx
je 0x1005dac4
lea eax, [esp + 0xd4c]
push eax
call fcn.10070dbb
test eax, eax
pop ecx
jbe 0x1005dac4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
push dword [esp + eax*4 + 0x90]
lea ecx, [esp + 0x14]
call fcn.10003e0b
xor esi, esi
lea eax, [esp + 0xd4c]
inc esi
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1184], esi
call fcn.10003e0b
lea edi, [esp + 0x10]
mov byte [esp + 0x1180], 2
call fcn.1005dc8d
lea edi, [esp + 0x14]
call fcn.1005dc8d
push ebx
lea ecx, [esp + 0x14]
call fcn.100212fb
push eax
mov ecx, edi
call fcn.10010946
test eax, eax
jge 0x1005db43
mov ecx, edi
call fcn.10003e76
or dword [esp + 0x1180], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10003e76
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 8
jb 0x1005da3a
lea eax, [esp + 0xec]
push eax
push dword [esp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1005d84a
xor esi, esi
cmp dword [esp + 0x28], ebx
jbe 0x1005dbce
push dword [esp + esi*4 + 0xd0]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], ebx
je 0x1005dbc3
lea eax, [esp + 0x31c]
push eax
push edi
mov dword [esp + 0x324], 0x428
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1005dbb3
or dword [0x1010658c], 4
mov dword [esp + 0x18], 1
lea eax, [esp + 0xb44]
jmp 0x1005d752
or dword [0x1010658c], 8
lea eax, [esp + 0x14]
push eax
mov ecx, 0x1010698c
mov dword [esp + 0x1c], esi
call fcn.10003e87
lea ecx, [esp + 0x14]
call fcn.10003e76
lea ecx, [esp + 0x10]
call fcn.10003e76
jmp 0x1005dc32
lea eax, [esp + 0x33c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, ebx
je 0x1005dba5
push 0x100d7a0c
push eax
call fcn.1007503e
test eax, eax
pop ecx
pop ecx
jne 0x1005db9f
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jne 0x1005dbf2
lea eax, [esp + 0x31c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1005db74
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x2c], 0xffffffff
inc esi
cmp esi, dword [esp + 0x28]
jb 0x1005dae9
call fcn.1005c2be
test eax, eax
jne 0x1005dc23
call fcn.1005c272
test eax, eax
jne 0x1005dc23
call fcn.1005bdf1
test eax, eax
je 0x1005dbfb
or dword [0x1010658c], 0x40
jmp 0x1005dc2a
or dword [0x1010658c], 0x10
jmp 0x1005dc2a
mov eax, dword [0x1010625c]
cmp eax, ebx
je 0x1005dc32
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x1005dc13
cmp dword [0x10106258], ebx
je 0x1005dc32
or dword [0x1010658c], 0x80
mov dword [esp + 0x18], ecx
jmp 0x1005dc32
or dword [0x1010658c], 0x20
mov dword [esp + 0x18], 1
cmp dword [esp + 0x34], 0xffffffff
je 0x1005dc43
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x24], 0xffffffff
je 0x1005dc54
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], 0xffffffff
je 0x1005dc65
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1160]
xor ecx, esp
call fcn.10070dd1
mov esp, ebp
pop ebp
ret