Function at 0x10028ec9
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Link many functions at runtime

Disassembly:
sub esp, 0xc18
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0xc14], eax
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0xc], ebp
cmp dword [0x1015568c], ebp
je 0x10028efb
push str.AttachDetours
push ebp
call fcn.1004122a
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, 0x44c
sub eax, edi
mov dword [0x102b4a30], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0x1015686c]
test ecx, 0x400
jne 0x10028f46
cmp byte [0x1015062c], 0
jne 0x10028f46
test ecx, 0x4000000
je 0x10028f41
push ebp
push eax
call fcn.1002f1fe
pop ecx
pop ecx
test al, al
jne 0x10028f46
call fcn.10036e27
call esi
sub eax, edi
mov dword [0x102b4a30], eax
cmp dword [0x1015568c], ebp
je 0x10028f64
push str.AttachDetours2
push ebp
call fcn.1004122a
pop ecx
pop ecx
call fcn.100310ab
test al, al
jne 0x10028f74
xor eax, eax
jmp 0x1002aea1
push ebx
mov esi, 0x800
push esi
push ebp
push 0x100fd9a8
call fcn.10044b80
push esi
push ebp
push 0x101459d0
call fcn.10044b80
mov eax, 0xc45a91b5
mov edi, 0x1ff
push edi
mov dword [0x100fd9a8], eax
mov dword [0x101459d0], eax
lea eax, [esp + 0x41]
push ebp
push eax
mov dword [0x10077d34], 1
mov byte [esp + 0x48], 0
call fcn.10044b80
mov al, byte [0x102d2d98]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x24
test al, 2
je 0x10029248
push edi
lea eax, [esp + 0x229]
push ebp
push eax
mov byte [esp + 0x230], 0
call fcn.10044b80
push edi
lea eax, [esp + 0x835]
push ebp
push eax
mov byte [esp + 0x83c], 0
call fcn.10044b80
push edi
lea eax, [esp + 0x441]
push ebp
push eax
mov byte [esp + 0x448], 0
call fcn.10044b80
push edi
lea eax, [esp + 0x64d]
push ebp
push eax
mov byte [esp + 0x654], 0
call fcn.10044b80
push edi
lea eax, [esp + 0xa59]
push ebp
push eax
mov byte [esp + 0xa60], 0
call fcn.10044b80
add esp, 0x3c
cmp byte [0x10083690], 0
mov edi, 0x100614b0
mov eax, str.__s_12
jne 0x10029068
mov eax, edi
push str.LhSetExclusiveACL
push eax
lea eax, [esp + 0x22c]
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [0x10083690], 0
mov eax, str.__s_16
jne 0x1002908e
mov eax, edi
push str.LhInstallHook
push eax
lea eax, [esp + 0x82c]
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [0x10083690], 0
mov eax, str.__s_0
jne 0x100290b4
mov eax, edi
push str.LhUninstallAllHooks
push eax
lea eax, [esp + 0x42c]
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [0x10083690], 0
mov eax, str.__s_0
jne 0x100290da
mov eax, edi
push str.LhWaitForPendingRemovals
push eax
lea eax, [esp + 0x62c]
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [0x10083690], 0
je 0x100290fe
mov edi, str.__s_28
push str.RhInjectLibrary
lea eax, [esp + 0xa28]
push edi
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [0x10083690], 0
je 0x10029137
cmp dword [0x10077cd8], 0x501
jg 0x10029130
mov eax, str.RFxEZH32.dll
jmp 0x1002914d
mov eax, str.AF_EZH32.dll
jmp 0x1002914d
cmp dword [0x10077cd8], 0x501
mov eax, str.RFxEZH64.dll
jle 0x1002914d
mov eax, str.AF_EZH64.dll
push eax
push 0x10153e28
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.10044ec8
add esp, 0x10
lea eax, [esp + 0x24]
push eax
call ebx
lea ecx, [esp + 0x224]
push ecx
push eax
mov dword [0x10184ecc], eax
call esi
mov dword [0x10184eb0], eax
lea eax, [esp + 0x824]
push eax
push dword [0x10184ecc]
call esi
mov dword [0x10184eb4], eax
lea eax, [esp + 0x424]
push eax
push dword [0x10184ecc]
call esi
mov dword [0x10184eb8], eax
lea eax, [esp + 0x624]
push eax
push dword [0x10184ecc]
call esi
mov dword [0x10184ebc], eax
lea eax, [esp + 0xa24]
push eax
push dword [0x10184ecc]
call esi
mov dword [0x10184ec0], eax
cmp dword [0x1015568c], ebp
je 0x10029216
push dword [0x10184ebc]
lea eax, [esp + 0x28]
push dword [0x10184eb8]
push dword [0x10184eb4]
push dword [0x10184eb0]
push dword [0x10184ecc]
push eax
lea eax, [esp + 0x23c]
push eax
push str.EZH_Engine_begin__s__s__p__p:_p:_p:_p
push ebp
call fcn.1004122a
add esp, 0x24
mov dword [0x10151ce4], ebp
cmp dword [0x10184eb0], ebp
je 0x1002ae91
cmp dword [0x10184eb4], ebp
je 0x1002ae91
cmp dword [0x10184eb8], ebp
je 0x1002ae91
cmp dword [0x10184ec0], ebp
jmp 0x100292a9
test al, 4
je 0x100292b0
push str.AF_MH.dll
push 0x10153e28
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.10044ec8
add esp, 0x10
lea eax, [esp + 0x24]
push eax
call ebx
push str.CallMe
push eax
mov dword [0x10184ed0], eax
call esi
mov dword [0x10184ea8], eax
cmp dword [0x1015568c], ebp
je 0x100292a3
push eax
push dword [0x10184ed0]
lea eax, [esp + 0x2c]
push eax
push str.MH_Engine_begin__s___p___p_
push ebp
call fcn.1004122a
add esp, 0x14
cmp dword [0x10184ea8], ebp
jne 0x100292d6
jmp 0x1002ae91
cmp dword [0x1015568c], ebp
je 0x100292c5
push str.MS_Engine_begin
push ebp
call fcn.1004122a
pop ecx
pop ecx
call fcn.1005acd0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1005b4e0
cmp dword [0x1015568c], ebp
je 0x100292eb
push str.Engine_launched
push ebp
call fcn.1004122a
pop ecx
pop ecx
test byte [0x101570b8], 0x20
je 0x100292fb
mov byte [0x1015396a], 1
cmp dword [0x10151cdc], 0x20000
jae 0x10029310
cmp dword [0x102b4a3c], 8
jne 0x10029317
mov byte [0x1015396a], 1
cmp dword [0x10186950], ebp
jne 0x100293d4
cmp dword [0x10186954], ebp
jne 0x100293d4
push str.Psapi.dll
call ebx
mov edi, eax
mov ebp, str.GetModuleFileNameExA
test edi, edi
je 0x1002937f
cmp dword [0x10186950], 0
jne 0x10029353
push ebp
push edi
call esi
mov dword [0x10186950], eax
cmp dword [0x10186954], 0
jne 0x10029369
push str.GetModuleFileNameExW
push edi
call esi
mov dword [0x10186954], eax
cmp dword [0x10186958], 0
jne 0x1002937f
push str.GetModuleBaseNameW
push edi
call esi
mov dword [0x10186958], eax
cmp dword [0x10186950], 0
jne 0x100293d4
cmp dword [0x10186954], 0
jne 0x100293d4
push ebp
mov edi, str.kernel32.dll
push edi
call ebx
push eax
call esi
cmp dword [0x10186954], 0
mov dword [0x10186950], eax
jne 0x100293bb
push str.GetModuleFileNameExW
push edi
call ebx
push eax
call esi
mov dword [0x10186954], eax
cmp dword [0x10186958], 0
jne 0x100293d4
push str.GetModuleBaseNameW
push edi
call ebx
push eax
call esi
mov dword [0x10186958], eax
cmp byte [0x1015396a], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, str.ntdll.dll
jne 0x10029614
push 0x1006721c
push 0x1002842b
push 0x101be520
call fcn.1000d389
push 0x1006720c
push 0x10027f84
push 0x1018806c
call fcn.1000d389
add esp, 0x18
cmp byte [0x102d2d90], 0
mov ebx, str.CreateProcessInternalW
je 0x1002948d
cmp dword [0x10186960], 0
jne 0x10029455
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186960], eax
test eax, eax
je 0x10029455
push ebx
push 0x100275bf
push 0x10186960
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186964], 0
jne 0x1002948d
push str.CreateProcessInternalA
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186964], eax
test eax, eax
je 0x1002948d
push str.CreateProcessInternalA
push 0x10027b27
push 0x10186964
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bed64], 0
je 0x10029614
push 0x1006a110
push 0x1001a8a7
push 0x101b5628
call fcn.1000d389
push 0x1006a100
push 0x1001a8d5
push 0x10188048
call fcn.1000d389
push 0x1006a0f0
push 0x1001a903
push 0x101be514
call fcn.1000d389
push 0x1006a0e0
push 0x1001a9de
push 0x101be55c
call fcn.1000d389
add esp, 0x30
cmp dword [0x10186960], 0
jne 0x1002951d
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186960], eax
test eax, eax
je 0x1002951d
push ebx
push 0x100275bf
push 0x10186960
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186964], 0
jne 0x10029552
mov ebx, str.CreateProcessInternalA
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186964], eax
test eax, eax
je 0x10029552
push ebx
push 0x10027b27
push 0x10186964
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186968], 0
mov ebx, str.ZwCreateProcess
jne 0x10029570
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186968], eax
test eax, eax
je 0x10029583
push ebx
push 0x1001a6b5
push 0x10186968
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186970], 0
jne 0x1002959c
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186970], eax
test eax, eax
je 0x100295b3
push str.ntCreateProcess
push 0x1001a7ae
push 0x10186970
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018696c], 0
mov ebx, str.ZwCreateProcessEx
jne 0x100295d1
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018696c], eax
test eax, eax
je 0x100295e4
push ebx
push 0x1001a730
push 0x1018696c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186974], 0
jne 0x100295fd
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186974], eax
test eax, eax
je 0x10029614
push str.ntCreateProcessEx
push 0x1001a829
push 0x10186974
call fcn.1000d389
add esp, 0xc
xor eax, eax
cmp dword [0x10151cdc], eax
jne 0x100296e3
cmp dword [0x10156ca4], eax
jne 0x100296e3
cmp byte [0x1015688a], al
jne 0x100296e3
cmp dword [0x1015568c], eax
jne 0x100296e3
test dword [0x10077cd0], 0x8000000
jne 0x10029662
test dword [0x10150864], 0x20000000
je 0x100296e3
mov ebx, str.ZwQuerySystemInformation
cmp dword [0x10186980], eax
jne 0x1002967f
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186980], eax
test eax, eax
je 0x10029692
push ebx
push 0x1001b905
push 0x10186980
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186950], 0
je 0x100296e3
cmp dword [0x10186954], 0
je 0x100296e3
push str.GetModuleFileNameExW
push 0x1001b6ee
push 0x10186954
call fcn.1000d389
push str.GetModuleBaseNameW
push 0x1001b854
push 0x10186958
call fcn.1000d389
push 0x1006a06c
push 0x1001b79f
push 0x10077cf0
call fcn.1000d389
add esp, 0x24
test byte [0x101570d8], 4
je 0x10029788
cmp dword [0x101570ac], 0
je 0x10029788
call fcn.100330c8
push 0x1006a058
push 0x1001dc2b
push 0x101be538
call fcn.1000d389
push 0x1006a044
push 0x1001dc66
push 0x101acab0
call fcn.1000d389
and dword [esp + 0x2c], 0
add esp, 0x18
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ole32.dll_OleGetClipboard]
test eax, eax
jne 0x10029788
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [0x10153970], eax
test ecx, ecx
je 0x10029759
mov ecx, dword [ecx + 0xc]
mov dword [0x101869a4], ecx
cmp dword [0x101869a4], 0
je 0x1002977e
push str.IDataObjectGetData
push 0x1001b691
push 0x101869a4
call fcn.1000d389
mov eax, dword [0x10153970]
add esp, 0xc
test eax, eax
je 0x10029788
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x10151cdc], 0
jne 0x1002991f
test dword [0x10077cd0], 0x10000000
jne 0x100297b1
test dword [0x10150864], 0x20000000
je 0x100298bf
push 0x10154628
call fcn.1002eced
pop ecx
test al, al
jne 0x100297d8
cmp byte [0x1015688a], al
jne 0x100297d8
test dword [0x10077cd0], 0x20000000
je 0x100298b6
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x100298b6
push 0x400
call fcn.10044f63
mov ebx, eax
mov dword [esp], 0x1006a028
push ebx
call fcn.100078c1
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
pop ecx
pop ecx
push 0
lea ecx, [esp + 0x1c]
push ecx
xor ecx, ecx
push ecx
push ebx
push ecx
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
jl 0x100298af
cmp dword [esp + 0x18], 0
je 0x100298a5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0x10072270
push 0
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x100298a5
mov eax, dword [esp + 0x1c]
mov dword [0x10184c94], eax
test eax, eax
je 0x100298a5
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0x20
push 0
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x100298a5
mov eax, dword [esp + 0x20]
mov dword [0x10184c98], eax
test eax, eax
je 0x100298a5
cmp dword [0x101852dc], 0
jne 0x1002988e
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [0x101852dc], eax
test eax, eax
je 0x100298a5
push str.IEnumIDList_Next
push 0x1001d5d1
push 0x101852dc
call fcn.1000d389
add esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call fcn.10044ebd
pop ecx
cmp dword [0x10151cdc], 0
jne 0x1002991f
test dword [0x10077cd0], 0x2000000
jne 0x100298d7
test dword [0x10077cc8], 0x8000
je 0x1002991f
push 0x1006a004
push 0x1001be89
push 0x101b6390
call fcn.1000d389
add esp, 0xc
cmp dword [0x101868f0], 0
mov ebx, str.ZwEnumerateKey
jne 0x1002990c
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x101868f0], eax
test eax, eax
je 0x1002991f
push ebx
push 0x1001bbbd
push 0x101868f0
call fcn.1000d389
add esp, 0xc
test dword [0x10152564], 0x100000
jne 0x1002ae88
push str.Mswsock.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x10029968
cmp dword [0x10184ec4], 0
jne 0x10029952
push str.TransmitFile
push ebx
call esi
mov dword [0x10184ec4], eax
cmp dword [0x10184ec8], 0
jne 0x10029968
push str.TransmitPackets
push ebx
call esi
mov dword [0x10184ec8], eax
xor ebx, ebx
cmp dword [0x10184ec4], ebx
je 0x10029989
push str.TransmitFile
push 0x10017103
push 0x10184ec4
call fcn.1000d389
add esp, 0xc
cmp dword [0x10184ec8], ebx
je 0x100299a8
push str.TransmitPackets
push 0x10017300
push 0x10184ec8
call fcn.1000d389
add esp, 0xc
push str.bind
push 0x1001707f
push 0x101acaa4
call fcn.1000d389
push str.inet_ntoa
push 0x100170bf
push 0x10188024
call fcn.1000d389
push str.send
push 0x10017456
push 0x101b562c
call fcn.1000d389
push 0x10067260
push 0x100175cf
push 0x101be504
call fcn.1000d389
push str.sendto
push 0x1001773c
push 0x101b639c
call fcn.1000d389
push 0x1006724c
push 0x1001786a
push 0x101be550
call fcn.1000d389
add esp, 0x48
push 0x10069fc4
push 0x1001d055
push 0x1018807c
call fcn.1000d389
add esp, 0xc
test dword [0x10156880], 0x1000
jne 0x10029a5d
push str.socket
push 0x10016ab3
push 0x101be4e0
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186978], ebx
jne 0x10029a8d
mov ebx, str.ZwTerminateProcess
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186978], eax
test eax, eax
je 0x10029a8d
push ebx
push 0x10017bd8
push 0x10186978
call fcn.1000d389
add esp, 0xc
test byte [0x10077cdc], 1
je 0x1002a3bf
push 0x10069f94
push 0x10025ca0
push 0x101b63ac
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186928], 0
jne 0x10029ae2
mov ebx, str.ZwDeleteFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186928], eax
test eax, eax
je 0x10029ae2
push ebx
push 0x10025e42
push 0x10186928
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186914], 0
jne 0x10029b13
mov ebx, str.ZwOpenFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186914], eax
test eax, eax
je 0x10029b13
push ebx
push 0x1002518a
push 0x10186914
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186920], 0
mov ebx, str.ZwCreateFile
jne 0x10029b44
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186920], eax
test eax, eax
je 0x10029b44
push ebx
push 0x10025f3d
push 0x10186920
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bed64], 0
je 0x10029c14
test dword [0x10156880], 0x10000
jne 0x10029c14
cmp dword [0x101570ac], 3
jne 0x10029c14
push str.memcpy
push 0x10016a51
push 0x10077cf4
call fcn.1000d389
push str.wmemcpy
push 0x10016a89
push 0x10077cf8
call fcn.1000d389
push str.memcpy_s
push 0x10016a8f
push 0x10077cfc
call fcn.1000d389
push str.wmemcpy_s
push 0x10016a95
push 0x10077d00
call fcn.1000d389
push str.strcpy
push 0x10016a9b
push 0x10077d04
call fcn.1000d389
push str.wcscpy
push 0x10016aa1
push 0x10077d08
call fcn.1000d389
add esp, 0x48
push str.strcpy_s
push 0x10016aa7
push 0x10077d0c
call fcn.1000d389
push str.wcscpy_s
push 0x10016aad
push 0x10077d10
call fcn.1000d389
add esp, 0x18
push 0x100671f0
push 0x10021cc8
push 0x101be54c
call fcn.1000d389
add esp, 0xc
cmp byte [0x102d2d93], 0
je 0x10029c8a
cmp dword [0x101539c8], 0
mov ebx, str.CreateFile2
jne 0x10029c72
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x101539c8], eax
test eax, eax
jne 0x10029c72
cmp byte [0x102d2d91], al
je 0x10029c85
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x101539c8], eax
test eax, eax
je 0x10029c85
push ebx
push 0x10021354
push 0x101539c8
call fcn.1000d389
add esp, 0xc
mov ebx, str.ZwCreateFile
cmp byte [0x1014edb8], 0
jne 0x10029cbc
cmp dword [0x10156ca4], 0xa
je 0x10029cbc
test dword [0x1015686c], 0x20000000
jne 0x10029cbc
push str.q_dir.exe
push 0x10154228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10029ce8
cmp dword [0x10186920], 0
jne 0x10029ce8
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186920], eax
test eax, eax
je 0x10029ce8
push ebx
push 0x10025f3d
push 0x10186920
call fcn.1000d389
add esp, 0xc
xor eax, eax
mov ebx, bind
cmp dword [0x10156ca4], eax
je 0x10029d7b
test dword [0x10156880], ebx
jne 0x1002a2dd
test dword [0x101570d8], 0x200000
je 0x10029d7b
cmp dword [0x1015568c], eax
je 0x10029d28
push 0x10069f04
push eax
call fcn.1004122a
pop ecx
pop ecx
push 0x10069ee8
push 0x10017aab
push 0x10077d28
call fcn.1000d389
push 0x10069ed8
push 0x10017aec
push 0x10077d2c
call fcn.1000d389
push 0x10069ecc
push 0x10017a17
push 0x10188054
call fcn.1000d389
push 0x10069eb8
push 0x10017b57
push 0x101b561c
call fcn.1000d389
add esp, 0x30
test dword [0x10156880], ebx
jne 0x1002a2dd
cmp byte [0x10077497], 0
je 0x1002a2dd
cmp byte [0x100774b3], 0
je 0x1002a2dd
push 0x10066d60
push 0x1001c2a7
push 0x101b63a4
call fcn.1000d389
push 0x10066e04
push 0x1001c523
push 0x10188044
call fcn.1000d389
push 0x10066db8
push 0x1001c3fb
push 0x10188030
call fcn.1000d389
push 0x10066e54
push 0x1001c5eb
push 0x1018805c
call fcn.1000d389
add esp, 0x30
cmp dword [0x10186904], 0
jne 0x10029e25
mov ebx, str.ZwQueryDirectoryFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186904], eax
test eax, eax
je 0x10029e25
push ebx
push 0x100203d8
push 0x10186904
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186908], 0
jne 0x10029e5f
cmp byte [0x102d2d90], 0
je 0x10029e5f
mov ebx, str.ZwQueryDirectoryFileEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186908], eax
test eax, eax
je 0x10029e5f
push ebx
push 0x10020536
push 0x10186908
call fcn.1000d389
add esp, 0xc
cmp byte [0x102d2d91], 0
jne 0x10029e75
cmp dword [0x102bed64], 0
je 0x1002a1b9
cmp dword [0x10186918], 0
jne 0x10029ea6
mov ebx, str.NtOpenFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186918], eax
test eax, eax
je 0x10029ea6
push ebx
push 0x10025749
push 0x10186918
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186924], 0
jne 0x10029ed7
mov ebx, str.NtCreateFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186924], eax
test eax, eax
je 0x10029ed7
push ebx
push 0x100264d1
push 0x10186924
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018690c], 0
jne 0x10029f11
cmp byte [0x102d2d90], 0
je 0x10029f11
mov ebx, str.NtQueryDirectoryFile
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018690c], eax
test eax, eax
je 0x10029f11
push ebx
push 0x10020677
push 0x1018690c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186910], 0
jne 0x10029f4b
cmp byte [0x102d2d90], 0
je 0x10029f4b
mov ebx, str.NtQueryDirectoryFileEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186910], eax
test eax, eax
je 0x10029f4b
push ebx
push 0x100207d5
push 0x10186910
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186930], 0
jne 0x10029f7c
mov ebx, str.ZwCreateDirectoryObject
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186930], eax
test eax, eax
je 0x10029f7c
push ebx
push 0x1001c6a3
push 0x10186930
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186934], 0
jne 0x10029fad
mov ebx, str.ZwCreateDirectoryObjectEx
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10186934], eax
test eax, eax
je 0x10029fad
push ebx
push 0x1001c7a1
push 0x10186934
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018692c], 0
jne 0x10029fde
mov ebx, str.ZwOpenDirectoryObject
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x1018692c], eax
test eax, eax
je 0x10029fde
push ebx
push 0x1001c8a5
push 0x1018692c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186938], 0
jne 0x1002a027
mov ebx, 0x10066cec
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10186938], eax
test eax, eax
jne 0x1002a014
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186938], eax
test eax, eax
je 0x1002a027
push ebx
push 0x1001c201
push 0x10186938
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bed64], 0
je 0x1002a1b9
cmp dword [0x1018694c], 0
jne 0x1002a087
push str.FindFirstStreamW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x1018694c], eax
mov ebx, str.Kernel32.dll
test eax, eax
jne 0x1002a06e
push str.FindFirstStreamW
push ebx
call edi
push eax
call esi
mov dword [0x1018694c], eax
test eax, eax
je 0x1002a08c
push str.FindFirstStreamW
push 0x1001cee8
push 0x1018694c
call fcn.1000d389
add esp, 0xc
jmp 0x1002a08c
mov ebx, str.Kernel32.dll
cmp dword [0x10186944], 0
jne 0x1002a0c1
push str.FindFirstFileTransactedW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10186944], eax
test eax, eax
jne 0x1002a0c1
push str.FindFirstFileTransactedW
push ebx
call edi
push eax
call esi
mov dword [0x10186944], eax
test eax, eax
je 0x1002a0d8
push str.FindFirstFileTransactedW
push 0x1001c9a3
push 0x10186944
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186940], 0
jne 0x1002a10d
push str.FindFirstFileNameW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10186940], eax
test eax, eax
jne 0x1002a10d
push str.FindFirstFileNameW
push ebx
call edi
push eax
call esi
mov dword [0x10186940], eax
test eax, eax
je 0x1002a124
push str.FindFirstFileNameW
push 0x1001cb08
push 0x10186940
call fcn.1000d389
add esp, 0xc
cmp dword [0x1018693c], 0
jne 0x1002a159
push str.FindFirstFileNameTransactedW
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x1018693c], eax
test eax, eax
jne 0x1002a159
push str.FindFirstFileNameTransactedW
push ebx
call edi
push eax
call esi
mov dword [0x1018693c], eax
test eax, eax
je 0x1002a170
push str.FindFirstFileNameTransactedW
push 0x1001cc4a
push 0x1018693c
call fcn.1000d389
add esp, 0xc
cmp dword [0x10186948], 0
mov ebx, str.FindFirstStreamTransactedW
jne 0x1002a1a6
push ebx
push str.KernelBase.dll
call edi
push eax
call esi
mov dword [0x10186948], eax
test eax, eax
jne 0x1002a1a6
push ebx
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x10186948], eax
test eax, eax
je 0x1002a1b9
push ebx
push 0x1001cd9d
push 0x10186948
call fcn.1000d389
add esp, 0xc
cmp dword [0x10151cdc], 0x10000
jae 0x1002a1f9
test dword [0x1015086c], 0x80000
je 0x1002a1f9
mov ebx, str.ZwSetValueKey
push ebx
push ebp
call edi
push eax
call esi
mov dword [0x10188018], eax
test eax, eax
je 0x1002a1f9
push ebx
push 0x1001df59
push 0x10188018
call fcn.1000d389
add esp, 0xc
test dword [0x1015086c], 0x280000
je 0x1002a244
push 0x10069e98
push 0x10018093
push 0x101be4ec
call fcn.1000d389
push 0x10069e88
push 0x10017ef1
push 0x101acaa0
call fcn.1000d389
push 0x10069e78
push 0x10018295
push 0x101b5640
call fcn.1000d389
add esp, 0x24
test dword [0x1015086c], 0x400000
je 0x1002a267
push 0x100671fc
push 0x1001d744
push 0x1018801c
call fcn.1000d389
add esp, 0xc
cmp dword [0x102bed64], 0
je 0x1002a2dd
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, str.InitiateShutdownW
test eax, eax
je 0x1002a296
cmp dword [0x101869e0], 0
jne 0x1002a29f
push ebx
push eax
call esi
mov dword [0x101869e0], eax
cmp dword [0x101869e0], 0
je 0x1002a2b2
push ebx
push 0x1001d78a
push 0x101869e0
call fcn.1000d389
add esp, 0xc
push 0x10069e3c
push 0x1001d7d6
push 0x101be558
call fcn.1000d389
push 0x10069e20
push 0x1001d822
push 0x101be4d8
call fcn.1000d389
add esp, 0x18
push str.Secur32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebp, ebp
mov ebx, str.EncryptMessage
cmp eax, ebp
je 0x1002a304
cmp dword [0x10186994], ebp
jne 0x1002a30c
push ebx
push eax
call esi
mov dword [0x10186994], eax
cmp dword [0x10186994], ebp
je 0x1002a319
push ebx
push 0x1001b059
push 0x10186994
jmp 0x1002a356
cmp dword [0x101570ac], 1
jne 0x1002a35e
push str.nspr4.dll
call edi
mov ebx, str.PR_Write
cmp eax, ebp
je 0x1002a343
cmp dword [0x1018802c], ebp
jne 0x1002a34b
push ebx
push eax
call esi
mov dword [0x1018802c], eax
cmp dword [0x1018802c], ebp
je 0x1002a35e
push ebx
push 0x1001b4d9
push 0x1018802c
call fcn.1000d389
add esp, 0xc
push str.nss3.dll
call edi
mov ebx, str.PK11_Encrypt
cmp eax, ebp
je 0x1002a37f
cmp dword [0x101b6394], ebp
jne 0x1002a387
push ebx
push eax
call esi
mov dword [0x101b6394], eax
cmp dword [0x101b6394], ebp
je 0x1002a39a
push ebx
push 0x1001af35
push 0x101b6394
call fcn.1000d389
add esp, 0xc
cmp byte [0x1015688a], 0
jne 0x1002a3bf
push 0x10069dc0
push 0x1001dc7c
push 0x101b63a0
call fcn.1000d389
add esp, 0xc
call fcn.100330c8
test byte [0x10077cdc], 2
je 0x1002a4c5
cmp dword [0x10156ca4], 0
jne 0x1002a49a
cmp dword [0x101570ac], 0
jne 0x1002a49a
push str.connect
push 0x1001aa16
push 0x10188038
call fcn.1000d389
push 0x10069dac
push 0x1001aa7b
push 0x10188040
call fcn.1000d389
add esp, 0x18
cmp dword [0x10077cd8], 0x500
mov ebx, str.IcmpSendEcho2
jne 0x1002a429
push str.Icmp.dll
jmp 0x1002a42e
push str.Iphlpapi.dll
call edi
mov ebp, eax
test ebp, ebp
je 0x1002a45e
cmp dword [0x101539c0], 0
jne 0x1002a44c
push str.IcmpSendEcho
push ebp
call esi
mov dword [0x101539c0], eax
cmp dword [0x101539c4], 0
jne 0x1002a45e
push ebx
push ebp
call esi
mov dword [0x101539c4], eax
cmp dword [0x101539c0], 0
je 0x1002a47e
push str.IcmpSendEcho
push 0x1001aaf4
push 0x101539c0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101539c4], 0
je 0x1002a49a
push ebx
push 0x1001ab66
push 0x101539c4
call fcn.1000d389
add esp, 0xc
test byte [0x1016ed68], 0x10
je 0x1002a4c5
push str.packet.dll
call edi
test eax, eax
je 0x1002a4c5
push 0x100688c0
push 0x1001559a
push 0x101b55f4
call fcn.1000d389
add esp, 0xc
test byte [0x10077cdc], 1
je 0x1002ae88
push 0x10069d64
push 0x1002326e
push 0x101b63a8
call fcn.1000d389
push 0x10069d58
push 0x100234a5
push 0x101be534
call fcn.1000d389
push 0x10069d4c
push 0x10022c49
push 0x1018804c
call fcn.1000d389
push 0x10069d40
push 0x10022ea7
push 0x101b5638
call fcn.1000d389
add esp, 0x30
cmp byte [0x102d2d93], 0
je 0x1002a563
cmp dword [0x101539cc], 0
mov ebp, str.CopyFile2
jne 0x1002a550
push ebp
push str.Kernel32.dll
call edi
push eax
call esi
mov dword [0x101539cc], eax
test eax, eax
je 0x1002a563
push ebp
push 0x10023036
push 0x101539cc
call fcn.1000d389
add esp, 0xc
push 0x10069d28
push 0x10023a48
push 0x101acab4
call fcn.1000d389
push 0x10069d1c
push 0x10023cfa
push 0x101b55ec
call fcn.1000d389
push 0x10069d10
push 0x1002360d
push 0x101be50c
call fcn.1000d389
push 0x10069d04
push 0x10023896
push 0x1018808c
call fcn.1000d389
push 0x10068c34
push 0x10024198
push 0x101b5fe4
call fcn.1000d389
push 0x10068bd0
push 0x10023ecd
push 0x101be51c
call fcn.1000d389
mov ebp, 0x600
add esp, 0x48
cmp dword [0x10077cd8], ebp
jge 0x1002a616
push 0x10069cf0
push 0x100229fd
push 0x10188064
call fcn.1000d389
push 0x10069cdc
push 0x1002279d
push 0x101b5fdc
call fcn.1000d389
add esp, 0x18
xor ebx, ebx
cmp dword [0x10151cdc], ebx
jne 0x1002ae88
cmp dword [0x10077cd8], ebp
jl 0x1002a921
test byte [0x1015086c], 8
jne 0x1002a65c
cmp byte [0x1015688a], bl
jne 0x1002a65c
push 0x10154a28
call fcn.1002eb1d
pop ecx
test al, al
jne 0x1002a65c
cmp dword [0x10156ca4], ebx
je 0x1002a921
cmp byte [0x10077496], 0
je 0x1002a921
cmp dword [0x10077cbc], ebx
jne 0x1002a67e
cmp byte [0x1015686b], 0
je 0x1002a921
push 0
mov byte [0x10150896], 1
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x1015397c
push 0x10062ef4
push 1
push 0
push 0x10062ee4
call ebx
test eax, eax
jl 0x1002a921
mov eax, dword [0x1015397c]
test eax, eax
je 0x1002a921
mov ecx, dword [0x101869ac]
xor ebp, ebp
mov dword [0x10184c88], eax
cmp ecx, ebp
jne 0x1002a6d9
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x40]
mov dword [0x101869ac], ecx
cmp dword [0x101869b0], ebp
jne 0x1002a6ec
mov edx, dword [eax]
mov edx, dword [edx + 0x44]
mov dword [0x101869b0], edx
cmp dword [0x101869b4], ebp
jne 0x1002a6ff
mov edx, dword [eax]
mov edx, dword [edx + 0x30]
mov dword [0x101869b4], edx
cmp dword [0x101869b8], ebp
jne 0x1002a712
mov edx, dword [eax]
mov edx, dword [edx + 0x34]
mov dword [0x101869b8], edx
cmp dword [0x101869bc], ebp
jne 0x1002a725
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
mov dword [0x101869bc], edx
cmp dword [0x101869c0], ebp
jne 0x1002a738
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
mov dword [0x101869c0], edx
cmp dword [0x101869c4], ebp
jne 0x1002a74b
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
mov dword [0x101869c4], edx
cmp dword [0x101869c8], ebp
jne 0x1002a75d
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
mov dword [0x101869c8], eax
cmp ecx, ebp
je 0x1002a778
push str.CopyItem
push 0x10024fc3
push 0x101869ac
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869b0], ebp
je 0x1002a797
push str.CopyItems
push 0x10024f4f
push 0x101869b0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869b4], ebp
je 0x1002a7b6
push str.RenameItem
push 0x10024dce
push 0x101869b4
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869b8], ebp
je 0x1002a7d5
push str.RenameItems
push 0x10024d5a
push 0x101869b8
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869bc], ebp
je 0x1002a7f4
push str.MoveItem
push 0x10024ec2
push 0x101869bc
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869c0], ebp
je 0x1002a813
push str.MoveItems
push 0x10024e4e
push 0x101869c0
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869c4], ebp
je 0x1002a832
push str.DeleteItem
push 0x10024ccd
push 0x101869c4
call fcn.1000d389
add esp, 0xc
cmp dword [0x101869c8], ebp
je 0x1002a851
push str.DeleteItems
push 0x10024c4c
push 0x101869c8
call fcn.1000d389
add esp, 0xc
mov eax, dword [0x1015397c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test dword [0x10156880], 0x4000000
jne 0x1002a921
cmp dword [0x1018699c], 0
mov ebp, str.SHCreateStreamOnFileEx
jne 0x1002a896
push ebp
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [0x1018699c], eax
test eax, eax
je 0x1002a921
push 0x10153974
push 0x10062f14
push 1
push 0
push 0x10062f04
call ebx
test eax, eax
mov eax, dword [0x10153974]
jl 0x1002a8d9
test eax, eax
je 0x1002a8d9
mov ecx, dword [0x1015396c]
test ecx, ecx
jne 0x1002a8ca
mov ecx, eax
mov dword [0x1015396c], ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x1002a8d9
mov ecx, dword [ecx + 0x1c]
mov dword [0x101869a0], ecx
cmp dword [0x101869a0], 0
je 0x1002a917
cmp dword [0x1018699c], 0
je 0x1002a917
push ebp
push 0x100201c9
push 0x1018699c
call fcn.1000d389
push str.IPortableDeviceValuesSetStringValue
push 0x1001ff83
push 0x101869a0
call fcn.1000d389
mov eax, dword [0x10153974]
add esp, 0x18
test eax, eax
je 0x1002a921
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test byte [0x10077cdc], 1
je 0x1002aa87
test byte [0x102d2d98], 2
jne 0x1002a9f4
test dword [0x10156880], 0x400000
jne 0x1002a9f4
xor eax, eax
cmp dword [0x10156ca4], eax
jne 0x1002a9f4
cmp dword [0x101570ac], eax
jne 0x1002a9f4
cmp byte [0x1015688a], al
jne 0x1002a9f4
cmp dword [0x101570a8], eax
jne 0x1002a9f4
push 0x10069c28
push 0x100289c0
push 0x101be4f0
call fcn.1000d389
push 0x10069c1c
push 0x1001aca5
push 0x101be508
call fcn.1000d389
push 0x10069c14
push 0x1001abe1
push 0x101be518
call fcn.1000d389
push 0x10069c08
push 0x1001ac47
push 0x10188084
call fcn.1000d389
push 0x10069bf4
push 0x1001ad5d
push 0x101b563c
call fcn.1000d389
push 0x10069be8
push 0x1001ad26
push 0x10188034
call fcn.1000d389
add esp, 0x48
mov ebx, 0x4000000
test dword [0x10156880], ebx
jne 0x1002aa5c
push 0x100655fc
push 0x10154a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002aa32
push 0x10069bd8
push 0x100159e0
push 0x101be4f4
call fcn.1000d389
add esp, 0xc
jmp 0x1002ae88
test dword [0x10156880], ebx
jne 0x1002aa5c
test dword [0x1015687c], ebx
jne 0x1002aa5c
test byte [0x10150cc0], 2
je 0x1002aa5c
push 0x10069bc8
push 0x100158a7
push 0x101b5fd8
jmp 0x1002aa25
push str._nc.exe
push 0x10154228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002aa87
push 0x10069bbc
push 0x10026e74
push 0x101be548
call fcn.1000d389
add esp, 0xc
push str.TEAMVIEWER.EXE
push 0x10154a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002aab3
push 0x10069bd8
push 0x100159e0
push 0x101be4f4
call fcn.1000d389
add esp, 0xc
push 0x10154628
call fcn.1002eced
pop ecx
mov ebp, 0x20000000
test al, al
jne 0x1002aad7
test dword [0x10077cd0], ebp
jne 0x1002aad7
cmp byte [0x101570e7], al
je 0x1002aaf7
push 0x10069ecc
push 0x10017a17
push 0x10188054
call fcn.1000d389
add esp, 0xc
cmp byte [0x101570e7], 0
jne 0x1002aaff
test dword [0x10077cd0], ebp
je 0x1002ab63
push 0x10069bb0
push 0x10017993
push 0x101b5fd4
call fcn.1000d389
add esp, 0xc
test dword [0x10077cd0], ebp
je 0x1002ab63
push str.NetStat.exe
push 0x10154a28
call fcn.100077d0
pop ecx
pop ecx
test eax, eax
jne 0x1002ab63
push 0x10069b94
push 0x1001aebf
push 0x101be4e8
call fcn.1000d389
push 0x10069b84
push 0x1001ad94
push 0x10188060
call fcn.1000d389
add esp, 0x18
jmp 0x1002ae88
test byte [0x10156880], 2
jne 0x1002abd5
push 0x10069b78
push 0x10028cf5
push 0x101b5610
call fcn.1000d389
push 0x10069b6c
push 0x1001d871
push 0x101be4dc
call fcn.1000d389
add esp, 0x18
push str.Netapi32.dll
call edi
mov dword [0x101539f0], eax
test eax, eax
je 0x1002abd5
cmp dword [0x1018695c], 0
mov ebp, str.NetUserChangePassword
jne 0x1002abc2
push ebp
push eax
call esi
mov dword [0x1018695c], eax
test eax, eax
je 0x1002abd5
push ebp
push 0x10028af6
push 0x1018695c
call fcn.1000d389
add esp, 0xc
test dword [0x10156880], 0x10000000
mov ebx, 0x10016caa
mov ebp, 0x10188088
jne 0x1002ac0f
test dword [0x1016ed68], 0x100
jne 0x1002ac0f
cmp dword [0x10156ca4], 0
je 0x1002ac0f
push 0x10069b34
push ebx
push ebp
call fcn.1000d389
add esp, 0xc
test dword [0x10156880], 0x2000000
jne 0x1002ac33
test byte [0x102b4a38], 0xe
je 0x1002ac33
push 0x10069b34
push ebx
push ebp
call fcn.1000d389
add esp, 0xc
test byte [0x10077cdc], 1
mov ebp, 0x10069b24
mov ebx, 0x4000
je 0x1002ae26
test dword [0x10156880], ebx
jne 0x1002ae26
push 0x10069b18
push 0x100185c1
push 0x101be510
call fcn.1000d389
push 0x10069b10
push 0x1001943f
push 0x101b55fc
call fcn.1000d389
push 0x10069c28
push 0x100289c0
push 0x101be4f0
call fcn.1000d389
add esp, 0x24
cmp byte [0x101570b0], 0
je 0x1002ad15
test dword [0x1015687c], ebx
je 0x1002ae26
cmp byte [0x10156889], 0
jne 0x1002ae26
cmp byte [0x1015688a], 0
jne 0x1002ae26
push str.Spoolss.dll
call edi
mov dword [0x101539f4], eax
test eax, eax
je 0x1002ae26
cmp dword [0x101539d0], 0
mov byte [0x10150895], 0
jne 0x1002ae26
push ebp
push eax
call esi
mov dword [0x101539d0], eax
test eax, eax
je 0x1002ae26
push ebp
push 0x10018434
push 0x10077d18
call fcn.1000d389
add esp, 0xc
jmp 0x1002ae26
cmp byte [0x1015688a], 0
jne 0x1002ae21
cmp byte [0x10156889], 0
jne 0x1002ae21
xor ebx, ebx
cmp dword [0x101539f4], ebx
jne 0x1002ae21
cmp dword [0x101539d0], ebx
jne 0x1002ae21
push str.winspool.drv
call edi
mov dword [0x101539f8], eax
cmp eax, ebx
je 0x1002ae21
mov byte [0x10150895], bl
cmp dword [0x101539d0], ebx
jne 0x1002ad8b
push ebp
push eax
call esi
mov dword [0x101539d0], eax
cmp eax, ebx
je 0x1002ad8b
push ebp
push 0x10018434
push 0x10077d18
call fcn.1000d389
add esp, 0xc
cmp dword [0x101539d4], ebx
jne 0x1002adbd
mov edi, 0x10069ae0
push edi
push dword [0x101539f8]
call esi
mov dword [0x101539d4], eax
cmp eax, ebx
je 0x1002adbd
push edi
push 0x100184f0
push 0x10077d1c
call fcn.1000d389
add esp, 0xc
cmp dword [0x101539d8], ebx
jne 0x1002adef
mov edi, 0x10069acc
push edi
push dword [0x101539f8]
call esi
mov dword [0x101539d8], eax
cmp eax, ebx
je 0x1002adef
push edi
push 0x100186ca
push 0x10077d20
call fcn.1000d389
add esp, 0xc
cmp dword [0x101539dc], ebx
jne 0x1002ae21
mov edi, 0x10069abc
push edi
push dword [0x101539f8]
call esi
mov dword [0x101539dc], eax
cmp eax, ebx
je 0x1002ae21
push edi
push 0x10018744
push 0x10077d24
call fcn.1000d389
add esp, 0xc
mov ebx, 0x4000
test byte [0x1015ad00], 3
jne 0x1002ae3f
test dword [0x1015687c], ebx
jne 0x1002ae88
test dword [0x10156880], ebx
jne 0x1002ae88
push ebp
push 0x10018434
push 0x10077d18
mov byte [0x1014edbb], 1
mov byte [0x10150895], 0
call fcn.1000d389
push 0x10069ab4
push 0x100193a8
push 0x101b5fe0
call fcn.1000d389
push 0x10069aa8
push 0x10019309
push 0x10188078
call fcn.1000d389
add esp, 0x24
test byte [0x102d2d98], 1
jne 0x1002ae96
xor eax, eax
inc eax
jmp 0x1002aea0
lea eax, [esp + 0x10]
push eax
call fcn.1005af30
pop ebx
mov ecx, dword [esp + 0xc20]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10044b6f
add esp, 0xc18
ret