Function at 0x1002904c
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Link many functions at runtime

Disassembly:
sub esp, 0xc18
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0xc14], eax
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0xc], ebp
cmp dword [0x1015668c], ebp
je 0x1002907e
push str.AttachDetours
push ebp
call fcn.100412e2
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, 0x44c
sub eax, edi
mov dword [0x102b5a30], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0x1015786c]
test ecx, 0x400
jne 0x100290c9
cmp byte [0x1015162c], 0
jne 0x100290c9
test ecx, 0x4000000
je 0x100290c4
push ebp
push eax
call fcn.1002f384
pop ecx
pop ecx
test al, al
jne 0x100290c9
call fcn.10036fbe
call esi
sub eax, edi
mov dword [0x102b5a30], eax
cmp dword [0x1015668c], ebp
je 0x100290e7
push str.AttachDetours2
push ebp
call fcn.100412e2
pop ecx
pop ecx
call fcn.10031231
test al, al
jne 0x100290f7
xor eax, eax
jmp 0x1002b024
push ebx
mov esi, 0x800
push esi
push ebp
push 0x100fe9a8
call fcn.10045030
push esi
push ebp
push 0x101469d0
call fcn.10045030
mov eax, 0xc45a91b5
mov edi, 0x1ff
push edi
mov dword [0x100fe9a8], eax
mov dword [0x101469d0], eax
lea eax, [esp + 0x41]
push ebp
push eax
mov dword [0x10078d34], 1
mov byte [esp + 0x48], 0
call fcn.10045030
mov al, byte [0x102d3d98]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x24
test al, 2
je 0x100293cb
push edi
lea eax, [esp + 0x229]
push ebp
push eax
mov byte [esp + 0x230], 0
call fcn.10045030
push edi
lea eax, [esp + 0x835]
push ebp
push eax
mov byte [esp + 0x83c], 0
call fcn.10045030
push edi
lea eax, [esp + 0x441]
push ebp
push eax
mov byte [esp + 0x448], 0
call fcn.10045030
push edi
lea eax, [esp + 0x64d]
push ebp
push eax
mov byte [esp + 0x654], 0
call fcn.10045030
push edi
lea eax, [esp + 0xa59]
push ebp
push eax
mov byte [esp + 0xa60], 0
call fcn.10045030
add esp, 0x3c
cmp byte [0x10084690], 0
mov edi, 0x100614c0
mov eax, str.__s_12
jne 0x100291eb
mov eax, edi
push str.LhSetExclusiveACL
push eax
lea eax, [esp + 0x22c]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], 0
mov eax, str.__s_16
jne 0x10029211
mov eax, edi
push str.LhInstallHook
push eax
lea eax, [esp + 0x82c]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], 0
mov eax, str.__s_0
jne 0x10029237
mov eax, edi
push str.LhUninstallAllHooks
push eax
lea eax, [esp + 0x42c]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], 0
mov eax, str.__s_0
jne 0x1002925d
mov eax, edi
push str.LhWaitForPendingRemovals
push eax
lea eax, [esp + 0x62c]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], 0
je 0x10029281
mov edi, str.__s_28
push str.RhInjectLibrary
lea eax, [esp + 0xa28]
push edi
push eax
call fcn.10045378
add esp, 0xc
cmp byte [0x10084690], 0
je 0x100292ba
cmp dword [0x10078cd8], 0x501
jg 0x100292b3
mov eax, str.tcxEZH32.dll
jmp 0x100292d0
mov eax, str.tc_EZH32.dll
jmp 0x100292d0
cmp dword [0x10078cd8], 0x501
mov eax, str.tcxEZH64.dll
jle 0x100292d0
mov eax, str.tc_EZH64.dll
push eax
push 0x10154e28
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.10045378
add esp, 0x10
lea eax, [esp + 0x24]
push eax
call ebx
lea ecx, [esp + 0x224]
push ecx
push eax
mov dword [0x10185ed0], eax
call esi
mov dword [0x10185eb4], eax
lea eax, [esp + 0x824]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185eb8], eax
lea eax, [esp + 0x424]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ebc], eax
lea eax, [esp + 0x624]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ec0], eax
lea eax, [esp + 0xa24]
push eax
push dword [0x10185ed0]
call esi
mov dword [0x10185ec4], eax
cmp dword [0x1015668c], ebp
je 0x10029399
push dword [0x10185ec0]
lea eax, [esp + 0x28]
push dword [0x10185ebc]
push dword [0x10185eb8]
push dword [0x10185eb4]
push dword [0x10185ed0]
push eax
lea eax, [esp + 0x23c]
push eax
push str.EZH_Engine_begin__s__s__p__p:_p:_p:_p
push ebp
call fcn.100412e2
add esp, 0x24
mov dword [0x10152ce4], ebp
cmp dword [0x10185eb4], ebp
je 0x1002b014
cmp dword [0x10185eb8], ebp
je 0x1002b014
cmp dword [0x10185ebc], ebp
je 0x1002b014
cmp dword [0x10185ec4], ebp
jmp 0x1002942c
test al, 4
je 0x10029433
push str.tc_MH.dll
push 0x10154e28
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.10045378
add esp, 0x10
lea eax, [esp + 0x24]
push eax
call ebx
push str.CallMe
push eax
mov dword [0x10185ed4], eax
call esi
mov dword [0x10185eac], eax
cmp dword [0x1015668c], ebp
je 0x10029426
push eax
push dword [0x10185ed4]
lea eax, [esp + 0x2c]
push eax
push str.MH_Engine_begin__s___p___p_
push ebp
call fcn.100412e2
add esp, 0x14
cmp dword [0x10185eac], ebp
jne 0x10029459
jmp 0x1002b014
cmp dword [0x1015668c], ebp
je 0x10029448
push str.MS_Engine_begin
push ebp
call fcn.100412e2
pop ecx
pop ecx
call fcn.1005b180
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1005b990
cmp dword [0x1015668c], ebp
je 0x1002946e
push str.Engine_launched
push ebp
call fcn.100412e2
pop ecx
pop ecx
test byte [0x101580b8], 0x20
je 0x1002947e
mov byte [0x1015496a], 1
cmp dword [0x10152cdc], 0x20000
jae 0x10029493
cmp dword [0x102b5a3c], 8
jne 0x1002949a
mov byte [0x1015496a], 1
cmp dword [0x10187954], ebp
jne 0x10029557
cmp dword [0x10187958], ebp
jne 0x10029557
push str.Psapi.dll
call ebx
mov edi, eax
mov ebp, str.GetModuleFileNameExA
test edi, edi
je 0x10029502
cmp dword [0x10187954], 0
jne 0x100294d6
push ebp
push edi
call esi
mov dword [0x10187954], eax
cmp dword [0x10187958], 0
jne 0x100294ec
push str.GetModuleFileNameExW
push edi
call esi
mov dword [0x10187958], eax
cmp dword [0x1018795c], 0
jne 0x10029502
push str.GetModuleBaseNameW
push edi
call esi
mov dword [0x1018795c], eax
cmp dword [0x10187954], 0
jne 0x10029557
cmp dword [0x10187958], 0
jne 0x10029557
push ebp
mov edi, str.kernel32.dll
push edi
call ebx
push eax
call esi
cmp dword [0x10187958], 0
mov dword [0x10187954], eax
jne 0x1002953e
push str.GetModuleFileNameExW
push edi
call ebx
push eax
call esi
mov dword [0x10187958], eax
cmp dword [0x1018795c], 0
jne 0x10029557
push str.GetModuleBaseNameW
push edi
call ebx
push eax
call esi
mov dword [0x1018795c], eax
cmp byte [0x1015496a], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, str.ntdll.dll
jne 0x10029797
push 0x1006730c
push 0x100285ae
push 0x101bf524
call fcn.1000d389
push 0x100672fc
push 0x10028107
push 0x10189070
call fcn.1000d389
add esp, 0x18
cmp byte [0x102d3d90], 0
mov ebx, str.CreateProcessInternalW
je 0x10029610
cmp dword [0x10187964], 0
jne 0x100295d8
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10187964], eax
test eax, eax
je 0x100295d8
push ebx
push 0x10027742
push 0x10187964
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187968], 0
jne 0x10029610
push str.CreateProcessInternalA
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10187968], eax
test eax, eax
je 0x10029610
push str.CreateProcessInternalA
push 0x10027caa
push 0x10187968
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bfd64], 0
je 0x10029797
push 0x1006a228
push 0x1001aa2b
push 0x101b662c
call fcn.1000d389
push 0x1006a218
push 0x1001aa59
push 0x1018904c
call fcn.1000d389
push 0x1006a208
push 0x1001aa87
push 0x101bf518
call fcn.1000d389
push 0x1006a1f8
push 0x1001ab62
push 0x101bf560
call fcn.1000d389
add esp, 0x30
cmp dword [0x10187964], 0
jne 0x100296a0
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10187964], eax
test eax, eax
je 0x100296a0
push ebx
push 0x10027742
push 0x10187964
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187968], 0
jne 0x100296d5
mov ebx, str.CreateProcessInternalA
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10187968], eax
test eax, eax
je 0x100296d5
push ebx
push 0x10027caa
push 0x10187968
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018796c], 0
mov ebx, str.ZwCreateProcess
jne 0x100296f3
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018796c], eax
test eax, eax
je 0x10029706
push ebx
push 0x1001a839
push 0x1018796c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187974], 0
jne 0x1002971f
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187974], eax
test eax, eax
je 0x10029736
push str.ntCreateProcess
push 0x1001a932
push 0x10187974
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187970], 0
mov ebx, str.ZwCreateProcessEx
jne 0x10029754
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187970], eax
test eax, eax
je 0x10029767
push ebx
push 0x1001a8b4
push 0x10187970
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187978], 0
jne 0x10029780
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187978], eax
test eax, eax
je 0x10029797
push str.ntCreateProcessEx
push 0x1001a9ad
push 0x10187978
call fcn.1000d389
add esp, 0xc
xor eax, eax
cmp dword [0x10152cdc], eax
jne 0x10029866
cmp dword [0x10157ca4], eax
jne 0x10029866
cmp byte [0x1015788a], al
jne 0x10029866
cmp dword [0x1015668c], eax
jne 0x10029866
test dword [0x10078cd0], 0x8000000
jne 0x100297e5
test dword [0x10151864], 0x20000000
je 0x10029866
mov ebx, str.ZwQuerySystemInformation
cmp dword [0x10187984], eax
jne 0x10029802
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187984], eax
test eax, eax
je 0x10029815
push ebx
push 0x1001ba89
push 0x10187984
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187954], 0
je 0x10029866
cmp dword [0x10187958], 0
je 0x10029866
push str.GetModuleFileNameExW
push 0x1001b872
push 0x10187958
call fcn.1000d389
push str.GetModuleBaseNameW
push 0x1001b9d8
push 0x1018795c
call fcn.1000d389
push 0x1006a184
push 0x1001b923
push 0x10078cf0
call fcn.1000d389
add esp, 0x24
test byte [0x101580d8], 4
je 0x1002990b
cmp dword [0x101580ac], 0
je 0x1002990b
call fcn.1003324e
push 0x1006a170
push 0x1001ddaf
push 0x101bf53c
call fcn.1000d389
push 0x1006a15c
push 0x1001ddea
push 0x101adab4
call fcn.1000d389
and dword [esp + 0x2c], 0
add esp, 0x18
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ole32.dll_OleGetClipboard]
test eax, eax
jne 0x1002990b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [0x10154970], eax
test ecx, ecx
je 0x100298dc
mov ecx, dword [ecx + 0xc]
mov dword [0x101879a8], ecx
cmp dword [0x101879a8], 0
je 0x10029901
push str.IDataObjectGetData
push 0x1001b815
push 0x101879a8
call fcn.1000d389
mov eax, dword [0x10154970]
add esp, 0xc
test eax, eax
je 0x1002990b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x10152cdc], 0
jne 0x10029aa2
test dword [0x10078cd0], 0x10000000
jne 0x10029934
test dword [0x10151864], 0x20000000
je 0x10029a42
push 0x10155628
call fcn.1002ee73
pop ecx
test al, al
jne 0x1002995b
cmp byte [0x1015788a], al
jne 0x1002995b
test dword [0x10078cd0], 0x20000000
je 0x10029a39
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x10029a39
push 0x400
call fcn.10045413
mov ebx, eax
mov dword [esp], 0x1006a140
push ebx
call fcn.100078c1
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
pop ecx
pop ecx
push 0
lea ecx, [esp + 0x1c]
push ecx
xor ecx, ecx
push ecx
push ebx
push ecx
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
jl 0x10029a32
cmp dword [esp + 0x18], 0
je 0x10029a28
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0x100725fc
push 0
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x10029a28
mov eax, dword [esp + 0x1c]
mov dword [0x10185c98], eax
test eax, eax
je 0x10029a28
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0x20
push 0
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x10029a28
mov eax, dword [esp + 0x20]
mov dword [0x10185c9c], eax
test eax, eax
je 0x10029a28
cmp dword [0x101878e0], 0
jne 0x10029a11
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [0x101878e0], eax
test eax, eax
je 0x10029a28
push str.IEnumIDList_Next
push 0x1001d755
push 0x101878e0
call fcn.1000d389
add esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call fcn.1004536d
pop ecx
cmp dword [0x10152cdc], 0
jne 0x10029aa2
test dword [0x10078cd0], 0x2000000
jne 0x10029a5a
test dword [0x10078cc8], 0x8000
je 0x10029aa2
push 0x1006a11c
push 0x1001c00d
push 0x101b7394
call fcn.1000d389
add esp, 0xc
cmp dword [0x101878f4], 0
mov ebx, str.ZwEnumerateKey
jne 0x10029a8f
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x101878f4], eax
test eax, eax
je 0x10029aa2
push ebx
push 0x1001bd41
push 0x101878f4
call fcn.1000d389
add esp, 0xc
test dword [0x10153564], 0x100000
jne 0x1002b00b
push str.Mswsock.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x10029aeb
cmp dword [0x10185ec8], 0
jne 0x10029ad5
push str.TransmitFile
push ebx
call esi
mov dword [0x10185ec8], eax
cmp dword [0x10185ecc], 0
jne 0x10029aeb
push str.TransmitPackets
push ebx
call esi
mov dword [0x10185ecc], eax
xor ebx, ebx
cmp dword [0x10185ec8], ebx
je 0x10029b0c
push str.TransmitFile
push 0x10017287
push 0x10185ec8
call fcn.1000d389
add esp, 0xc
cmp dword [0x10185ecc], ebx
je 0x10029b2b
push str.TransmitPackets
push 0x10017484
push 0x10185ecc
call fcn.1000d389
add esp, 0xc
push str.bind
push 0x10017203
push 0x101adaa8
call fcn.1000d389
push str.inet_ntoa
push 0x10017243
push 0x10189028
call fcn.1000d389
push str.send
push 0x100175da
push 0x101b6630
call fcn.1000d389
push 0x10067350
push 0x10017753
push 0x101bf508
call fcn.1000d389
push str.sendto
push 0x100178c0
push 0x101b73a0
call fcn.1000d389
push 0x1006733c
push 0x100179ee
push 0x101bf554
call fcn.1000d389
add esp, 0x48
push 0x1006a0dc
push 0x1001d1d9
push 0x10189080
call fcn.1000d389
add esp, 0xc
test dword [0x10157880], 0x1000
jne 0x10029be0
push str.socket
push 0x10016c37
push 0x101bf4e4
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018797c], ebx
jne 0x10029c10
mov ebx, str.ZwTerminateProcess
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018797c], eax
test eax, eax
je 0x10029c10
push ebx
push 0x10017d5c
push 0x1018797c
call fcn.1000d389
add esp, 0xc
test byte [0x10078cdc], 1
je 0x1002a542
push 0x1006a0ac
push 0x10025e23
push 0x101bf4d8
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018792c], 0
jne 0x10029c65
mov ebx, str.ZwDeleteFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018792c], eax
test eax, eax
je 0x10029c65
push ebx
push 0x10025fc5
push 0x1018792c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187918], 0
jne 0x10029c96
mov ebx, str.ZwOpenFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187918], eax
test eax, eax
je 0x10029c96
push ebx
push 0x1002530d
push 0x10187918
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187924], 0
mov ebx, str.ZwCreateFile
jne 0x10029cc7
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187924], eax
test eax, eax
je 0x10029cc7
push ebx
push 0x100260c0
push 0x10187924
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bfd64], 0
je 0x10029d97
test dword [0x10157880], 0x10000
jne 0x10029d97
cmp dword [0x101580ac], 3
jne 0x10029d97
push str.memcpy
push 0x10016bd5
push 0x10078cf4
call fcn.1000d389
push str.wmemcpy
push 0x10016c0d
push 0x10078cf8
call fcn.1000d389
push str.memcpy_s
push 0x10016c13
push 0x10078cfc
call fcn.1000d389
push str.wmemcpy_s
push 0x10016c19
push 0x10078d00
call fcn.1000d389
push str.strcpy
push 0x10016c1f
push 0x10078d04
call fcn.1000d389
push str.wcscpy
push 0x10016c25
push 0x10078d08
call fcn.1000d389
add esp, 0x48
push str.strcpy_s
push 0x10016c2b
push 0x10078d0c
call fcn.1000d389
push str.wcscpy_s
push 0x10016c31
push 0x10078d10
call fcn.1000d389
add esp, 0x18
push 0x100672e0
push 0x10021e4b
push 0x101bf550
call fcn.1000d389
add esp, 0xc
cmp byte [0x102d3d93], 0
je 0x10029e0d
cmp dword [0x101549c8], 0
mov ebx, str.CreateFile2
jne 0x10029df5
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x101549c8], eax
test eax, eax
jne 0x10029df5
cmp byte [0x102d3d91], al
je 0x10029e08
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x101549c8], eax
test eax, eax
je 0x10029e08
push ebx
push 0x100214d7
push 0x101549c8
call fcn.1000d389
add esp, 0xc
mov ebx, str.ZwCreateFile
cmp byte [0x1014fdb8], 0
jne 0x10029e3f
cmp dword [0x10157ca4], 0xa
je 0x10029e3f
test dword [0x1015786c], 0x20000000
jne 0x10029e3f
push str.q_dir.exe
push 0x10155228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10029e6b
cmp dword [0x10187924], 0
jne 0x10029e6b
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187924], eax
test eax, eax
je 0x10029e6b
push ebx
push 0x100260c0
push 0x10187924
call fcn.1000d389
add esp, 0xc
xor eax, eax
mov ebx, bind
cmp dword [0x10157ca4], eax
je 0x10029efe
test dword [0x10157880], ebx
jne 0x1002a460
test dword [0x101580d8], 0x200000
je 0x10029efe
cmp dword [0x1015668c], eax
je 0x10029eab
push 0x1006a01c
push eax
call fcn.100412e2
pop ecx
pop ecx
push 0x1006a000
push 0x10017c2f
push 0x10078d28
call fcn.1000d389
push 0x10069ff0
push 0x10017c70
push 0x10078d2c
call fcn.1000d389
push 0x10069fe4
push 0x10017b9b
push 0x10189058
call fcn.1000d389
push 0x10069fd0
push 0x10017cdb
push 0x101b6620
call fcn.1000d389
add esp, 0x30
test dword [0x10157880], ebx
jne 0x1002a460
cmp byte [0x10078497], 0
je 0x1002a460
cmp byte [0x100784b3], 0
je 0x1002a460
push 0x10066e50
push 0x1001c42b
push 0x101b73a8
call fcn.1000d389
push 0x10066ef4
push 0x1001c6a7
push 0x10189048
call fcn.1000d389
push 0x10066ea8
push 0x1001c57f
push 0x10189034
call fcn.1000d389
push 0x10066f44
push 0x1001c76f
push 0x10189060
call fcn.1000d389
add esp, 0x30
cmp dword [0x10187908], 0
jne 0x10029fa8
mov ebx, str.ZwQueryDirectoryFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187908], eax
test eax, eax
je 0x10029fa8
push ebx
push 0x10020549
push 0x10187908
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018790c], 0
jne 0x10029fe2
cmp byte [0x102d3d90], 0
je 0x10029fe2
mov ebx, str.ZwQueryDirectoryFileEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018790c], eax
test eax, eax
je 0x10029fe2
push ebx
push 0x100206a7
push 0x1018790c
call fcn.1000d389
add esp, 0xc
cmp byte [0x102d3d91], 0
jne 0x10029ff8
cmp dword [0x102bfd64], 0
je 0x1002a33c
cmp dword [0x1018791c], 0
jne 0x1002a029
mov ebx, str.NtOpenFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018791c], eax
test eax, eax
je 0x1002a029
push ebx
push 0x100258cc
push 0x1018791c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187928], 0
jne 0x1002a05a
mov ebx, str.NtCreateFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187928], eax
test eax, eax
je 0x1002a05a
push ebx
push 0x10026654
push 0x10187928
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187910], 0
jne 0x1002a094
cmp byte [0x102d3d90], 0
je 0x1002a094
mov ebx, str.NtQueryDirectoryFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187910], eax
test eax, eax
je 0x1002a094
push ebx
push 0x100207e8
push 0x10187910
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187914], 0
jne 0x1002a0ce
cmp byte [0x102d3d90], 0
je 0x1002a0ce
mov ebx, str.NtQueryDirectoryFileEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187914], eax
test eax, eax
je 0x1002a0ce
push ebx
push 0x10020946
push 0x10187914
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187934], 0
jne 0x1002a0ff
mov ebx, str.ZwCreateDirectoryObject
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187934], eax
test eax, eax
je 0x1002a0ff
push ebx
push 0x1001c827
push 0x10187934
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187938], 0
jne 0x1002a130
mov ebx, str.ZwCreateDirectoryObjectEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187938], eax
test eax, eax
je 0x1002a130
push ebx
push 0x1001c925
push 0x10187938
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187930], 0
jne 0x1002a161
mov ebx, str.ZwOpenDirectoryObject
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10187930], eax
test eax, eax
je 0x1002a161
push ebx
push 0x1001ca29
push 0x10187930
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018793c], 0
jne 0x1002a1aa
mov ebx, 0x10066ddc
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x1018793c], eax
test eax, eax
jne 0x1002a197
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x1018793c], eax
test eax, eax
je 0x1002a1aa
push ebx
push 0x1001c385
push 0x1018793c
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bfd64], 0
je 0x1002a33c
cmp dword [0x10187950], 0
jne 0x1002a20a
push str.FindFirstStreamW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10187950], eax
mov ebx, str.Kernel32.dll
test eax, eax
jne 0x1002a1f1
push str.FindFirstStreamW
push ebx
call edi
push eax
call esi
mov dword [0x10187950], eax
test eax, eax
je 0x1002a20f
push str.FindFirstStreamW
push 0x1001d06c
push 0x10187950
call fcn.1000d389
add esp, 0xc
jmp 0x1002a20f
mov ebx, str.Kernel32.dll
cmp dword [0x10187948], 0
jne 0x1002a244
push str.FindFirstFileTransactedW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10187948], eax
test eax, eax
jne 0x1002a244
push str.FindFirstFileTransactedW
push ebx
call edi
push eax
call esi
mov dword [0x10187948], eax
test eax, eax
je 0x1002a25b
push str.FindFirstFileTransactedW
push 0x1001cb27
push 0x10187948
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187944], 0
jne 0x1002a290
push str.FindFirstFileNameW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10187944], eax
test eax, eax
jne 0x1002a290
push str.FindFirstFileNameW
push ebx
call edi
push eax
call esi
mov dword [0x10187944], eax
test eax, eax
je 0x1002a2a7
push str.FindFirstFileNameW
push 0x1001cc8c
push 0x10187944
call fcn.1000d389
add esp, 0xc
cmp dword [0x10187940], 0
jne 0x1002a2dc
push str.FindFirstFileNameTransactedW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10187940], eax
test eax, eax
jne 0x1002a2dc
push str.FindFirstFileNameTransactedW
push ebx
call edi
push eax
call esi
mov dword [0x10187940], eax
test eax, eax
je 0x1002a2f3
push str.FindFirstFileNameTransactedW
push 0x1001cdce
push 0x10187940
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018794c], 0
mov ebx, str.FindFirstStreamTransactedW
jne 0x1002a329
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x1018794c], eax
test eax, eax
jne 0x1002a329
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x1018794c], eax
test eax, eax
je 0x1002a33c
push ebx
push 0x1001cf21
push 0x1018794c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10152cdc], 0x10000
jae 0x1002a37c
test dword [0x1015186c], 0x80000
je 0x1002a37c
mov ebx, str.ZwSetValueKey
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018901c], eax
test eax, eax
je 0x1002a37c
push ebx
push 0x1001e0dd
push 0x1018901c
call fcn.1000d389
add esp, 0xc
test dword [0x1015186c], 0x280000
je 0x1002a3c7
push 0x10069fb0
push 0x10018217
push 0x101bf4f0
call fcn.1000d389
push 0x10069fa0
push 0x10018075
push 0x101adaa4
call fcn.1000d389
push 0x10069f90
push 0x10018419
push 0x101b6644
call fcn.1000d389
add esp, 0x24
test dword [0x1015186c], 0x400000
je 0x1002a3ea
push 0x100672ec
push 0x1001d8c8
push 0x10189020
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bfd64], 0
je 0x1002a460
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, str.InitiateShutdownW
test eax, eax
je 0x1002a419
cmp dword [0x101879e4], 0
jne 0x1002a422
push ebx
push eax
call esi
mov dword [0x101879e4], eax
cmp dword [0x101879e4], 0
je 0x1002a435
push ebx
push 0x1001d90e
push 0x101879e4
call fcn.1000d389
add esp, 0xc
push 0x10069f54
push 0x1001d95a
push 0x101bf55c
call fcn.1000d389
push 0x10069f38
push 0x1001d9a6
push 0x101bf4dc
call fcn.1000d389
add esp, 0x18
push str.Secur32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebp, ebp
mov ebx, str.EncryptMessage
cmp eax, ebp
je 0x1002a487
cmp dword [0x10187998], ebp
jne 0x1002a48f
push ebx
push eax
call esi
mov dword [0x10187998], eax
cmp dword [0x10187998], ebp
je 0x1002a49c
push ebx
push 0x1001b1dd
push 0x10187998
jmp 0x1002a4d9
cmp dword [0x101580ac], 1
jne 0x1002a4e1
push str.nspr4.dll
call edi
mov ebx, str.PR_Write
cmp eax, ebp
je 0x1002a4c6
cmp dword [0x10189030], ebp
jne 0x1002a4ce
push ebx
push eax
call esi
mov dword [0x10189030], eax
cmp dword [0x10189030], ebp
je 0x1002a4e1
push ebx
push 0x1001b65d
push 0x10189030
call fcn.1000d389
add esp, 0xc
push str.nss3.dll
call edi
mov ebx, str.PK11_Encrypt
cmp eax, ebp
je 0x1002a502
cmp dword [0x101b7398], ebp
jne 0x1002a50a
push ebx
push eax
call esi
mov dword [0x101b7398], eax
cmp dword [0x101b7398], ebp
je 0x1002a51d
push ebx
push 0x1001b0b9
push 0x101b7398
call fcn.1000d389
add esp, 0xc
cmp byte [0x1015788a], 0
jne 0x1002a542
push 0x10069ed8
push 0x1001de00
push 0x101b73a4
call fcn.1000d389
add esp, 0xc
call fcn.1003324e
test byte [0x10078cdc], 2
je 0x1002a648
cmp dword [0x10157ca4], 0
jne 0x1002a61d
cmp dword [0x101580ac], 0
jne 0x1002a61d
push str.connect
push 0x1001ab9a
push 0x1018903c
call fcn.1000d389
push 0x10069ec4
push 0x1001abff
push 0x10189044
call fcn.1000d389
add esp, 0x18
cmp dword [0x10078cd8], 0x500
mov ebx, str.IcmpSendEcho2
jne 0x1002a5ac
push str.Icmp.dll
jmp 0x1002a5b1
push str.Iphlpapi.dll
call edi
mov ebp, eax
test ebp, ebp
je 0x1002a5e1
cmp dword [0x101549c0], 0
jne 0x1002a5cf
push str.IcmpSendEcho
push ebp
call esi
mov dword [0x101549c0], eax
cmp dword [0x101549c4], 0
jne 0x1002a5e1
push ebx
push ebp
call esi
mov dword [0x101549c4], eax
cmp dword [0x101549c0], 0
je 0x1002a601
push str.IcmpSendEcho
push 0x1001ac78
push 0x101549c0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101549c4], 0
je 0x1002a61d
push ebx
push 0x1001acea
push 0x101549c4
call fcn.1000d389
add esp, 0xc
test byte [0x1016ef6c], 0x10
je 0x1002a648
push str.packet.dll
call edi
test eax, eax
je 0x1002a648
push 0x100689d8
push 0x1001571e
push 0x101b65f8
call fcn.1000d389
add esp, 0xc
test byte [0x10078cdc], 1
je 0x1002b00b
push 0x10069e7c
push 0x100233f1
push 0x101b73ac
call fcn.1000d389
push 0x10069e70
push 0x10023628
push 0x101bf538
call fcn.1000d389
push 0x10069e64
push 0x10022dcc
push 0x10189050
call fcn.1000d389
push 0x10069e58
push 0x1002302a
push 0x101b663c
call fcn.1000d389
add esp, 0x30
cmp byte [0x102d3d93], 0
je 0x1002a6e6
cmp dword [0x101549cc], 0
mov ebp, str.CopyFile2
jne 0x1002a6d3
push ebp
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x101549cc], eax
test eax, eax
je 0x1002a6e6
push ebp
push 0x100231b9
push 0x101549cc
call fcn.1000d389
add esp, 0xc
push 0x10069e40
push 0x10023bcb
push 0x101adab8
call fcn.1000d389
push 0x10069e34
push 0x10023e7d
push 0x101adabc
call fcn.1000d389
push 0x10069e28
push 0x10023790
push 0x101bf510
call fcn.1000d389
push 0x10069e1c
push 0x10023a19
push 0x10189090
call fcn.1000d389
push 0x10068d4c
push 0x1002431b
push 0x101b738c
call fcn.1000d389
push 0x10068ce8
push 0x10024050
push 0x101bf520
call fcn.1000d389
mov ebp, 0x600
add esp, 0x48
cmp dword [0x10078cd8], ebp
jge 0x1002a799
push 0x10069e08
push 0x10022b80
push 0x10189068
call fcn.1000d389
push 0x10069df4
push 0x10022920
push 0x101b6fe0
call fcn.1000d389
add esp, 0x18
xor ebx, ebx
cmp dword [0x10152cdc], ebx
jne 0x1002b00b
cmp dword [0x10078cd8], ebp
jl 0x1002aaa4
test byte [0x1015186c], 8
jne 0x1002a7df
cmp byte [0x1015788a], bl
jne 0x1002a7df
push 0x10155a28
call fcn.1002eca3
pop ecx
test al, al
jne 0x1002a7df
cmp dword [0x10157ca4], ebx
je 0x1002aaa4
cmp byte [0x10078496], 0
je 0x1002aaa4
cmp dword [0x10078cbc], ebx
jne 0x1002a801
cmp byte [0x1015786b], 0
je 0x1002aaa4
push 0
mov byte [0x10151896], 1
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x1015497c
push 0x10062f04
push 1
push 0
push 0x10062ef4
call ebx
test eax, eax
jl 0x1002aaa4
mov eax, dword [0x1015497c]
test eax, eax
je 0x1002aaa4
mov ecx, dword [0x101879b0]
xor ebp, ebp
mov dword [0x10185c8c], eax
cmp ecx, ebp
jne 0x1002a85c
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x40]
mov dword [0x101879b0], ecx
cmp dword [0x101879b4], ebp
jne 0x1002a86f
mov edx, dword [eax]
mov edx, dword [edx + 0x44]
mov dword [0x101879b4], edx
cmp dword [0x101879b8], ebp
jne 0x1002a882
mov edx, dword [eax]
mov edx, dword [edx + 0x30]
mov dword [0x101879b8], edx
cmp dword [0x101879bc], ebp
jne 0x1002a895
mov edx, dword [eax]
mov edx, dword [edx + 0x34]
mov dword [0x101879bc], edx
cmp dword [0x101879c0], ebp
jne 0x1002a8a8
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
mov dword [0x101879c0], edx
cmp dword [0x101879c4], ebp
jne 0x1002a8bb
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
mov dword [0x101879c4], edx
cmp dword [0x101879c8], ebp
jne 0x1002a8ce
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
mov dword [0x101879c8], edx
cmp dword [0x101879cc], ebp
jne 0x1002a8e0
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
mov dword [0x101879cc], eax
cmp ecx, ebp
je 0x1002a8fb
push str.CopyItem
push 0x10025146
push 0x101879b0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879b4], ebp
je 0x1002a91a
push str.CopyItems
push 0x100250d2
push 0x101879b4
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879b8], ebp
je 0x1002a939
push str.RenameItem
push 0x10024f51
push 0x101879b8
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879bc], ebp
je 0x1002a958
push str.RenameItems
push 0x10024edd
push 0x101879bc
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879c0], ebp
je 0x1002a977
push str.MoveItem
push 0x10025045
push 0x101879c0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879c4], ebp
je 0x1002a996
push str.MoveItems
push 0x10024fd1
push 0x101879c4
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879c8], ebp
je 0x1002a9b5
push str.DeleteItem
push 0x10024e50
push 0x101879c8
call fcn.1000d389
add esp, 0xc
cmp dword [0x101879cc], ebp
je 0x1002a9d4
push str.DeleteItems
push 0x10024dcf
push 0x101879cc
call fcn.1000d389
add esp, 0xc
mov eax, dword [0x1015497c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test dword [0x10157880], 0x4000000
jne 0x1002aaa4
cmp dword [0x101879a0], 0
mov ebp, str.SHCreateStreamOnFileEx
jne 0x1002aa19
push ebp
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [0x101879a0], eax
test eax, eax
je 0x1002aaa4
push 0x10154974
push 0x10062f24
push 1
push 0
push 0x10062f14
call ebx
test eax, eax
mov eax, dword [0x10154974]
jl 0x1002aa5c
test eax, eax
je 0x1002aa5c
mov ecx, dword [0x1015496c]
test ecx, ecx
jne 0x1002aa4d
mov ecx, eax
mov dword [0x1015496c], ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x1002aa5c
mov ecx, dword [ecx + 0x1c]
mov dword [0x101879a4], ecx
cmp dword [0x101879a4], 0
je 0x1002aa9a
cmp dword [0x101879a0], 0
je 0x1002aa9a
push ebp
push 0x1002033a
push 0x101879a0
call fcn.1000d389
push str.IPortableDeviceValuesSetStringValue
push 0x100200f4
push 0x101879a4
call fcn.1000d389
mov eax, dword [0x10154974]
add esp, 0x18
test eax, eax
je 0x1002aaa4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test byte [0x10078cdc], 1
je 0x1002ac0a
test byte [0x102d3d98], 2
jne 0x1002ab77
test dword [0x10157880], 0x400000
jne 0x1002ab77
xor eax, eax
cmp dword [0x10157ca4], eax
jne 0x1002ab77
cmp dword [0x101580ac], eax
jne 0x1002ab77
cmp byte [0x1015788a], al
jne 0x1002ab77
cmp dword [0x101580a8], eax
jne 0x1002ab77
push 0x10069d40
push 0x10028b43
push 0x101bf4f4
call fcn.1000d389
push 0x10069d34
push 0x1001ae29
push 0x101bf50c
call fcn.1000d389
push 0x10069d2c
push 0x1001ad65
push 0x101bf51c
call fcn.1000d389
push 0x10069d20
push 0x1001adcb
push 0x10189088
call fcn.1000d389
push 0x10069d0c
push 0x1001aee1
push 0x101b6640
call fcn.1000d389
push 0x10069d00
push 0x1001aeaa
push 0x10189038
call fcn.1000d389
add esp, 0x48
mov ebx, 0x4000000
test dword [0x10157880], ebx
jne 0x1002abdf
push 0x100656d4
push 0x10155a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002abb5
push 0x10069cf0
push 0x10015b64
push 0x101bf4f8
call fcn.1000d389
add esp, 0xc
jmp 0x1002b00b
test dword [0x10157880], ebx
jne 0x1002abdf
test dword [0x1015787c], ebx
jne 0x1002abdf
test byte [0x10151cc0], 2
je 0x1002abdf
push 0x10069ce0
push 0x10015a2b
push 0x101b6fdc
jmp 0x1002aba8
push str._nc.exe
push 0x10155228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ac0a
push 0x10069cd4
push 0x10026ff7
push 0x101bf54c
call fcn.1000d389
add esp, 0xc
push str.TEAMVIEWER.EXE
push 0x10155a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002ac36
push 0x10069cf0
push 0x10015b64
push 0x101bf4f8
call fcn.1000d389
add esp, 0xc
push 0x10155628
call fcn.1002ee73
pop ecx
mov ebp, 0x20000000
test al, al
jne 0x1002ac5a
test dword [0x10078cd0], ebp
jne 0x1002ac5a
cmp byte [0x101580eb], al
je 0x1002ac7a
push 0x10069fe4
push 0x10017b9b
push 0x10189058
call fcn.1000d389
add esp, 0xc
cmp byte [0x101580eb], 0
jne 0x1002ac82
test dword [0x10078cd0], ebp
je 0x1002ace6
push 0x10069cc8
push 0x10017b17
push 0x101b664c
call fcn.1000d389
add esp, 0xc
test dword [0x10078cd0], ebp
je 0x1002ace6
push str.NetStat.exe
push 0x10155a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002ace6
push 0x10069cac
push 0x1001b043
push 0x101bf4ec
call fcn.1000d389
push 0x10069c9c
push 0x1001af18
push 0x10189064
call fcn.1000d389
add esp, 0x18
jmp 0x1002b00b
test byte [0x10157880], 2
jne 0x1002ad58
push 0x10069c90
push 0x10028e78
push 0x101b6614
call fcn.1000d389
push 0x10069c84
push 0x1001d9f5
push 0x101bf4e0
call fcn.1000d389
add esp, 0x18
push str.Netapi32.dll
call edi
mov dword [0x101549f0], eax
test eax, eax
je 0x1002ad58
cmp dword [0x10187960], 0
mov ebp, str.NetUserChangePassword
jne 0x1002ad45
push ebp
push eax
call esi
mov dword [0x10187960], eax
test eax, eax
je 0x1002ad58
push ebp
push 0x10028c79
push 0x10187960
call fcn.1000d389
add esp, 0xc
test dword [0x10157880], 0x10000000
mov ebx, 0x10016e2e
mov ebp, 0x1018908c
jne 0x1002ad92
test dword [0x1016ef6c], 0x100
jne 0x1002ad92
cmp dword [0x10157ca4], 0
je 0x1002ad92
push 0x10069c4c
push ebx
push ebp
call fcn.1000d389
add esp, 0xc
test dword [0x10157880], 0x2000000
jne 0x1002adb6
test byte [0x102b5a38], 0xe
je 0x1002adb6
push 0x10069c4c
push ebx
push ebp
call fcn.1000d389
add esp, 0xc
test byte [0x10078cdc], 1
mov ebp, 0x10069c3c
mov ebx, 0x4000
je 0x1002afa9
test dword [0x10157880], ebx
jne 0x1002afa9
push 0x10069c30
push 0x10018745
push 0x101bf514
call fcn.1000d389
push 0x10069c28
push 0x100195c3
push 0x101b6600
call fcn.1000d389
push 0x10069d40
push 0x10028b43
push 0x101bf4f4
call fcn.1000d389
add esp, 0x24
cmp byte [0x101580b0], 0
je 0x1002ae98
test dword [0x1015787c], ebx
je 0x1002afa9
cmp byte [0x10157889], 0
jne 0x1002afa9
cmp byte [0x1015788a], 0
jne 0x1002afa9
push str.Spoolss.dll
call edi
mov dword [0x101549f4], eax
test eax, eax
je 0x1002afa9
cmp dword [0x101549d0], 0
mov byte [0x10151895], 0
jne 0x1002afa9
push ebp
push eax
call esi
mov dword [0x101549d0], eax
test eax, eax
je 0x1002afa9
push ebp
push 0x100185b8
push 0x10078d18
call fcn.1000d389
add esp, 0xc
jmp 0x1002afa9
cmp byte [0x1015788a], 0
jne 0x1002afa4
cmp byte [0x10157889], 0
jne 0x1002afa4
xor ebx, ebx
cmp dword [0x101549f4], ebx
jne 0x1002afa4
cmp dword [0x101549d0], ebx
jne 0x1002afa4
push str.winspool.drv
call edi
mov dword [0x101549f8], eax
cmp eax, ebx
je 0x1002afa4
mov byte [0x10151895], bl
cmp dword [0x101549d0], ebx
jne 0x1002af0e
push ebp
push eax
call esi
mov dword [0x101549d0], eax
cmp eax, ebx
je 0x1002af0e
push ebp
push 0x100185b8
push 0x10078d18
call fcn.1000d389
add esp, 0xc
cmp dword [0x101549d4], ebx
jne 0x1002af40
mov edi, 0x10069bf8
push edi
push dword [0x101549f8]
call esi
mov dword [0x101549d4], eax
cmp eax, ebx
je 0x1002af40
push edi
push 0x10018674
push 0x10078d1c
call fcn.1000d389
add esp, 0xc
cmp dword [0x101549d8], ebx
jne 0x1002af72
mov edi, 0x10069be4
push edi
push dword [0x101549f8]
call esi
mov dword [0x101549d8], eax
cmp eax, ebx
je 0x1002af72
push edi
push 0x1001884e
push 0x10078d20
call fcn.1000d389
add esp, 0xc
cmp dword [0x101549dc], ebx
jne 0x1002afa4
mov edi, 0x10069bd4
push edi
push dword [0x101549f8]
call esi
mov dword [0x101549dc], eax
cmp eax, ebx
je 0x1002afa4
push edi
push 0x100188c8
push 0x10078d24
call fcn.1000d389
add esp, 0xc
mov ebx, 0x4000
test byte [0x1015bd04], 3
jne 0x1002afc2
test dword [0x1015787c], ebx
jne 0x1002b00b
test dword [0x10157880], ebx
jne 0x1002b00b
push ebp
push 0x100185b8
push 0x10078d18
mov byte [0x1014fdbb], 1
mov byte [0x10151895], 0
call fcn.1000d389
push 0x10069bcc
push 0x1001952c
push 0x101b6fe4
call fcn.1000d389
push 0x10069bc0
push 0x1001948d
push 0x1018907c
call fcn.1000d389
add esp, 0x24
test byte [0x102d3d98], 1
jne 0x1002b019
xor eax, eax
inc eax
jmp 0x1002b023
lea eax, [esp + 0x10]
push eax
call fcn.1005b3e0
pop ebx
mov ecx, dword [esp + 0xc20]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1004501f
add esp, 0xc18
ret