Function at 0xde49b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe0cf00
mov eax, dword fs:[0]
push eax
mov eax, 0x1384
call fcn.00df4710
mov eax, dword [0xe19840]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0xab0], ebx
push eax
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xac0], ebx
call fcn.00de28b0
mov dword [esi], vtable.HHParams.0
mov esi, 0xe0e7e8
mov edi, 0xe0e7e0
mov dword [ebp - 4], ebx
mov dword [ebp - 0xd98], esi
mov dword [ebp - 0xd88], edi
lea ecx, [ebp - 0xd38]
mov byte [ebp - 4], 1
mov dword [ebp - 0xab0], 0x4000000
mov dword [ebp - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xd90], ebx
mov dword [ebp - 0xd8c], ebx
call fcn.00dd1c80
lea eax, [ebp - 0xd80]
push 0x20
lea ecx, [ebp - 0xd38]
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xcfc], ebx
call fcn.00dd51b0
mov byte [ebp - 0xcf8], al
cmp dword [ebp - 0xd00], ebx
jne 0xde4a92
mov eax, dword [ebp - 0xd2c]
or eax, 4
push ebx
push eax
lea ecx, [ebp - 0xd38]
call fcn.00dd1b50
mov ecx, dword [ebp - 0xd88]
mov edx, dword [ecx + 4]
mov dword [ebp + edx - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xd98]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp - 0xd98]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0xd80]
mov dword [ebp - 4], 6
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00dd2790
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0xd44], ebx
mov dword [ebp - 0xd40], ebx
lea ecx, [ebp - 0xd88]
push str.Scan_only_processes_with_given_PIDs
push ecx
mov byte [ebp - 4], 8
call fcn.00dd5f20
add esp, 8
mov dword [ebp - 0xee8], esi
mov dword [ebp - 0xed8], edi
lea ecx, [ebp - 0xe88]
mov byte [ebp - 4], 9
mov dword [ebp - 0xab0], 0x44000000
mov dword [ebp - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xee0], ebx
mov dword [ebp - 0xedc], ebx
call fcn.00dd1c80
lea edx, [ebp - 0xed0]
push 0x20
lea ecx, [ebp - 0xe88]
mov dword [ebp - 0xe50], edx
mov dword [ebp - 0xe4c], ebx
call fcn.00dd51b0
mov byte [ebp - 0xe48], al
cmp dword [ebp - 0xe50], ebx
jne 0xde4b8c
mov eax, dword [ebp - 0xe7c]
or eax, 4
push ebx
push eax
lea ecx, [ebp - 0xe88]
call fcn.00dd1b50
mov eax, dword [ebp - 0xed8]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp - 0xee8]
mov eax, dword [edx + 4]
mov dword [ebp + eax - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov ecx, dword [ebp - 0xee8]
mov edx, dword [ecx + 4]
lea ecx, [ebp - 0xed0]
mov dword [ebp - 4], 0xe
mov dword [ebp + edx - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00dd2790
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0xe94], ebx
mov dword [ebp - 0xe90], ebx
push str.0xa90
push 0x3b
push str.Example:_5367
lea eax, [ebp - 0xed8]
push 0xe0e818
push eax
mov byte [ebp - 4], 0x10
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd61e0
add esp, 8
push eax
call fcn.00dd5f20
push 0xb0
call fcn.00df3e67
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x11
mov esi, 0xf
cmp edi, ebx
je 0xde4c99
push 3
push 0xe0ea1c
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe0], ebx
mov byte [ebp - 0xf0], bl
call fcn.00dd4610
push 0x3b
push ebx
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xab0], 0x44000001
call fcn.00ddba70
mov dword [edi], vtable.paramkit::IntListParam.0
jmp 0xde4c9b
xor edi, edi
mov ecx, dword [ebp - 0xabc]
push edi
mov dword [ebp - 4], 0x13
call fcn.00de2190
test byte [ebp - 0xab0], 1
mov eax, 0x10
mov dword [ebp - 4], eax
je 0xde4cef
and dword [ebp - 0xab0], 0xfffffffe
cmp dword [ebp - 0xdc], eax
jb 0xde4cdd
mov edx, dword [ebp - 0xf0]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe0], ebx
mov byte [ebp - 0xf0], bl
push 3
push 0xe0ea1c
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
call fcn.00dd4610
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0xee8]
mov byte [ebp - 4], 0x14
call fcn.00dde7c0
mov dword [ebp - 0xab4], eax
lea ecx, [ebp - 0x9b0]
push ecx
lea ecx, [ebp - 0xd98]
mov byte [ebp - 4], 0x15
call fcn.00dde7c0
mov dword [ebp - 0xab8], eax
mov edi, dword [ebp - 0xabc]
lea edx, [ebp - 0x64]
push edx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 0x16
call fcn.00dd4b60
mov dword [ebp - 0xad0], eax
mov edi, dword [edi + 0x24]
cmp eax, edi
je 0xde4dc6
mov edx, dword [eax + 0x1c]
add eax, 0xc
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0xac0], edx
jb 0xde4d76
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
cmp ecx, edx
jae 0xde4d7f
mov edx, ecx
cmp dword [ebp - 0x50], 0x10
mov ecx, dword [ebp - 0x64]
jae 0xde4d8b
lea ecx, [ebp - 0x64]
push edx
push eax
push ecx
call fcn.00dd1050
add esp, 0xc
cmp eax, ebx
jne 0xde4db7
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xac0]
cmp eax, ecx
jae 0xde4dac
or eax, 0xffffffff
jmp 0xde4db5
xor edx, edx
cmp eax, ecx
setne dl
mov eax, edx
cmp eax, ebx
setl al
cmp al, bl
jne 0xde4dc6
lea eax, [ebp - 0xad0]
jmp 0xde4dd2
mov dword [ebp - 0xad4], edi
lea eax, [ebp - 0xad4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xabc]
cmp eax, dword [ecx + 0x24]
je 0xde4e0a
mov edi, dword [eax + 0x28]
cmp edi, ebx
je 0xde4e0a
mov edx, dword [ebp - 0xab8]
push 0xffffffffffffffff
push ebx
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
mov eax, dword [ebp - 0xab4]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
cmp dword [ebp - 0x99c], 0x10
jb 0xde4e22
mov ecx, dword [ebp - 0x9b0]
push ecx
call fcn.00df3292
add esp, 4
cmp dword [ebp - 0x8bc], 0x10
mov dword [ebp - 0x99c], esi
mov dword [ebp - 0x9a0], ebx
mov byte [ebp - 0x9b0], bl
jb 0xde4e4c
mov edx, dword [ebp - 0x8d0]
push edx
call fcn.00df3292
add esp, 4
cmp dword [ebp - 0x50], 0x10
mov dword [ebp - 0x8bc], esi
mov dword [ebp - 0x8c0], ebx
mov byte [ebp - 0x8d0], bl
jb 0xde4e70
mov eax, dword [ebp - 0x64]
push eax
call fcn.00df3292
add esp, 4
lea ecx, [ebp - 0xe88]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov byte [ebp - 4], 8
call fcn.00dd2fb0
lea ecx, [ebp - 0xe88]
mov edi, vtable.std::ios_base.0
push ecx
mov dword [ebp - 0xe88], edi
call fcn.00df25ba
add esp, 4
lea ecx, [ebp - 0xd38]
mov byte [ebp - 4], bl
call fcn.00dd2fb0
lea edx, [ebp - 0xd38]
push edx
mov dword [ebp - 0xd38], edi
call fcn.00df25ba
add esp, 4
mov dword [ebp - 0xf90], 0xe0e7e8
mov dword [ebp - 0xf80], 0xe0e7e0
lea ecx, [ebp - 0xf30]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xac0], 4
mov dword [ebp - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xf88], ebx
mov dword [ebp - 0xf84], ebx
call fcn.00dd1c80
lea eax, [ebp - 0xf78]
push 0x20
lea ecx, [ebp - 0xf30]
mov dword [ebp - 0xef8], eax
mov dword [ebp - 0xef4], ebx
call fcn.00dd51b0
mov byte [ebp - 0xef0], al
cmp dword [ebp - 0xef8], ebx
jne 0xde4f4b
mov eax, dword [ebp - 0xf24]
or eax, 4
push ebx
push eax
lea ecx, [ebp - 0xf30]
call fcn.00dd1b50
mov ecx, dword [ebp - 0xf80]
mov edx, dword [ecx + 4]
mov edi, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov dword [ebp + edx - 0xf80], edi
mov eax, dword [ebp - 0xf90]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp - 0xf90]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0xf78]
mov dword [ebp - 4], 0x1c
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00dd2790
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0xf3c], ebx
mov dword [ebp - 0xf38], ebx
lea ecx, [ebp - 0xf80]
push str.Scan_only_processes_with_given_names.
push ecx
mov byte [ebp - 4], 0x1e
call fcn.00dd5f20
add esp, 8
mov dword [ebp - 0xe40], 0xe0e7e8
mov dword [ebp - 0xe30], 0xe0e7e0
lea ecx, [ebp - 0xde0]
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xac0], 0x44
mov dword [ebp - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xe38], ebx
mov dword [ebp - 0xe34], ebx
call fcn.00dd1c80
lea edx, [ebp - 0xe28]
push 0x20
lea ecx, [ebp - 0xde0]
mov dword [ebp - 0xda8], edx
mov dword [ebp - 0xda4], ebx
call fcn.00dd51b0
mov byte [ebp - 0xda0], al
cmp dword [ebp - 0xda8], ebx
jne 0xde504e
mov eax, dword [ebp - 0xdd4]
or eax, 4
push ebx
push eax
lea ecx, [ebp - 0xde0]
call fcn.00dd1b50
mov eax, dword [ebp - 0xe30]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - 0xe30], edi
mov edx, dword [ebp - 0xe40]
mov eax, dword [edx + 4]
mov dword [ebp + eax - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov ecx, dword [ebp - 0xe40]
mov edx, dword [ecx + 4]
lea ecx, [ebp - 0xe28]
mov dword [ebp - 4], 0x24
mov dword [ebp + edx - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00dd2790
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0xdec], ebx
mov dword [ebp - 0xde8], ebx
push str.firefox.exe
push 0x3b
push str.Example:_iexplore.exe
lea eax, [ebp - 0xe30]
push 0xe0e818
push eax
mov byte [ebp - 4], 0x26
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd61e0
add esp, 8
push eax
call fcn.00dd5f20
push 0xb0
call fcn.00df3e67
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x27
cmp edi, ebx
je 0xde5149
push 5
push str.pname
lea ecx, [ebp - 0x668]
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x658], ebx
mov byte [ebp - 0x668], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 2
push 0x3b
push ebx
lea ecx, [ebp - 0x668]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x28
call fcn.00ddba70
jmp 0xde514b
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x29
call fcn.00de2190
test byte [ebp - 0xab0], 2
mov dword [ebp - 4], 0x26
je 0xde519f
and dword [ebp - 0xab0], 0xfffffffd
cmp dword [ebp - 0x654], 0x10
jb 0xde518d
mov edx, dword [ebp - 0x668]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x658], ebx
mov byte [ebp - 0x668], bl
push 5
push str.pname
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
call fcn.00dd4610
lea eax, [ebp - 0x908]
push eax
lea ecx, [ebp - 0xe40]
mov byte [ebp - 4], 0x2a
call fcn.00dde7c0
mov dword [ebp - 0xac0], eax
lea ecx, [ebp - 0xa90]
push ecx
lea ecx, [ebp - 0xf90]
mov byte [ebp - 4], 0x2b
call fcn.00dde7c0
mov dword [ebp - 0xab8], eax
mov edi, dword [ebp - 0xabc]
lea edx, [ebp - 0x48]
push edx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 0x2c
call fcn.00dd4b60
mov dword [ebp - 0xad8], eax
mov edi, dword [edi + 0x24]
cmp eax, edi
je 0xde5276
mov edx, dword [eax + 0x1c]
add eax, 0xc
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0xab4], edx
jb 0xde5226
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
cmp ecx, edx
jae 0xde522f
mov edx, ecx
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [ebp - 0x48]
jae 0xde523b
lea ecx, [ebp - 0x48]
push edx
push eax
push ecx
call fcn.00dd1050
add esp, 0xc
cmp eax, ebx
jne 0xde5267
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xab4]
cmp eax, ecx
jae 0xde525c
or eax, 0xffffffff
jmp 0xde5265
xor edx, edx
cmp eax, ecx
setne dl
mov eax, edx
cmp eax, ebx
setl al
cmp al, bl
jne 0xde5276
lea eax, [ebp - 0xad8]
jmp 0xde5282
mov dword [ebp - 0xadc], edi
lea eax, [ebp - 0xadc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xabc]
cmp eax, dword [ecx + 0x24]
je 0xde52ba
mov edi, dword [eax + 0x28]
cmp edi, ebx
je 0xde52ba
mov edx, dword [ebp - 0xab8]
push 0xffffffffffffffff
push ebx
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
mov eax, dword [ebp - 0xac0]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0xa7c], edi
jb 0xde52d6
mov ecx, dword [ebp - 0xa90]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xa7c], esi
mov dword [ebp - 0xa80], ebx
mov byte [ebp - 0xa90], bl
cmp dword [ebp - 0x8f4], edi
jb 0xde52ff
mov edx, dword [ebp - 0x908]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x8f4], esi
mov dword [ebp - 0x8f8], ebx
mov byte [ebp - 0x908], bl
cmp dword [ebp - 0x34], edi
jb 0xde5322
mov eax, dword [ebp - 0x48]
push eax
call fcn.00df3292
add esp, 4
lea ecx, [ebp - 0xde0]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
mov byte [ebp - 4], 0x1e
call fcn.00dd2fb0
lea ecx, [ebp - 0xde0]
mov edi, vtable.std::ios_base.0
push ecx
mov dword [ebp - 0xde0], edi
call fcn.00df25ba
add esp, 4
lea ecx, [ebp - 0xf30]
mov byte [ebp - 4], bl
call fcn.00dd2fb0
lea edx, [ebp - 0xf30]
push edx
mov dword [ebp - 0xf30], edi
call fcn.00df25ba
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x1188]
call fcn.00dde690
lea eax, [ebp - 0x1178]
push str.Make_a_unique__timestamped_directory_for_the_output_of_each_scan.
push eax
mov byte [ebp - 4], 0x2d
call fcn.00dd5f20
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x1038]
call fcn.00dde690
push str.Prevents_overwriting_results_from_previous_scans.
lea ecx, [ebp - 0x1028]
push 0xe0e818
push ecx
mov byte [ebp - 4], 0x2e
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd5f20
push 0x7c
call fcn.00df3e67
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x2f
cmp edi, ebx
je 0xde542a
push 5
push str.uniqd
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x128], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 4
push ebx
lea edx, [ebp - 0x128]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x30
call fcn.00ddb990
jmp 0xde542c
xor eax, eax
mov edi, dword [ebp - 0xabc]
push eax
mov ecx, edi
mov dword [ebp - 4], 0x31
call fcn.00de2190
test byte [ebp - 0xab0], 4
mov dword [ebp - 4], 0x2e
je 0xde5482
and dword [ebp - 0xab0], 0xfffffffb
cmp dword [ebp - 0x114], 0x10
jb 0xde5470
mov eax, dword [ebp - 0x128]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x128], bl
push 5
push str.uniqd
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5b0], ebx
mov byte [ebp - 0x5c0], bl
call fcn.00dd4610
lea ecx, [ebp - 0x940]
push ecx
lea ecx, [ebp - 0x1038]
mov byte [ebp - 4], 0x32
call fcn.00dde7c0
mov dword [ebp - 0xab8], eax
lea edx, [ebp - 0x860]
push edx
lea ecx, [ebp - 0x1188]
mov byte [ebp - 4], 0x33
call fcn.00dde7c0
mov dword [ebp - 0xab4], eax
lea eax, [ebp - 0x5c0]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x34
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde551a
mov ecx, dword [ebp - 0xab4]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
mov edx, dword [ebp - 0xab8]
push 0xffffffffffffffff
push ebx
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x84c], edi
jb 0xde5536
mov eax, dword [ebp - 0x860]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x84c], esi
mov dword [ebp - 0x850], ebx
mov byte [ebp - 0x860], bl
cmp dword [ebp - 0x92c], edi
jb 0xde555f
mov ecx, dword [ebp - 0x940]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x92c], esi
mov dword [ebp - 0x930], ebx
mov byte [ebp - 0x940], bl
cmp dword [ebp - 0x5ac], edi
jb 0xde5588
mov edx, dword [ebp - 0x5c0]
push edx
call fcn.00df3292
add esp, 4
lea ecx, [ebp - 0xfd8]
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5b0], ebx
mov byte [ebp - 0x5c0], bl
mov byte [ebp - 4], 0x2d
call fcn.00dd2fb0
lea eax, [ebp - 0xfd8]
mov edi, vtable.std::ios_base.0
push eax
mov dword [ebp - 0xfd8], edi
call fcn.00df25ba
add esp, 4
lea ecx, [ebp - 0x1128]
mov byte [ebp - 4], bl
call fcn.00dd2fb0
lea ecx, [ebp - 0x1128]
push ecx
mov dword [ebp - 0x1128], edi
call fcn.00df25ba
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x10e0]
call fcn.00dde690
lea edx, [ebp - 0x10d0]
push str.Do_not_scan_process_es_with_given_name_s.
push edx
mov byte [ebp - 4], 0x35
call fcn.00dd5f20
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x12d8]
call fcn.00dde690
push str.conhost.exe
push 0x3b
push str.Example:_explorer.exe
lea eax, [ebp - 0x12c8]
push 0xe0e818
push eax
mov byte [ebp - 4], 0x36
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd61e0
add esp, 8
push eax
call fcn.00dd5f20
push 0xb0
call fcn.00df3e67
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x37
cmp edi, ebx
je 0xde56b7
push 7
push str.pignore
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x150], ebx
mov byte [ebp - 0x160], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 8
push 0x3b
push ebx
lea ecx, [ebp - 0x160]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x38
call fcn.00ddba70
jmp 0xde56b9
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x39
call fcn.00de2190
test byte [ebp - 0xab0], 8
mov dword [ebp - 4], 0x36
je 0xde570d
and dword [ebp - 0xab0], 0xfffffff7
cmp dword [ebp - 0x14c], 0x10
jb 0xde56fb
mov edx, dword [ebp - 0x160]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x150], ebx
mov byte [ebp - 0x160], bl
push 7
push str.pignore
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x444], ebx
mov byte [ebp - 0x454], bl
call fcn.00dd4610
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x12d8]
mov byte [ebp - 4], 0x3a
call fcn.00dde7c0
mov dword [ebp - 0xab8], eax
lea ecx, [ebp - 0xa58]
push ecx
lea ecx, [ebp - 0x10e0]
mov byte [ebp - 4], 0x3b
call fcn.00dde7c0
mov dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xabc]
lea edx, [ebp - 0x454]
push edx
mov byte [ebp - 4], 0x3c
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde57a9
mov eax, dword [ebp - 0xab4]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
mov ecx, dword [ebp - 0xab8]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0xa44], edi
jb 0xde57c5
mov edx, dword [ebp - 0xa58]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa48], ebx
mov byte [ebp - 0xa58], bl
cmp dword [ebp - 0x964], edi
jb 0xde57ee
mov eax, dword [ebp - 0x978]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x964], esi
mov dword [ebp - 0x968], ebx
mov byte [ebp - 0x978], bl
cmp dword [ebp - 0x440], edi
jb 0xde5817
mov ecx, dword [ebp - 0x454]
push ecx
call fcn.00df3292
add esp, 4
lea ecx, [ebp - 0x1278]
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x444], ebx
mov byte [ebp - 0x454], bl
mov byte [ebp - 4], 0x35
call fcn.00dd2fb0
lea edx, [ebp - 0x1278]
mov edi, vtable.std::ios_base.0
push edx
mov dword [ebp - 0x1278], edi
call fcn.00df25ba
add esp, 4
lea ecx, [ebp - 0x1080]
mov byte [ebp - 4], bl
call fcn.00dd2fb0
lea eax, [ebp - 0x1080]
push eax
mov dword [ebp - 0x1080], edi
call fcn.00df25ba
push 0x88
call fcn.00df3e67
mov edi, eax
add esp, 8
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x3d
cmp edi, ebx
je 0xde58d1
push 6
push str.ptimes
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x188], ebx
mov byte [ebp - 0x198], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x10
push 1
push ebx
lea ecx, [ebp - 0x198]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x3e
call fcn.00dd8340
jmp 0xde58d3
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x3f
call fcn.00de2190
test byte [ebp - 0xab0], 0x10
mov dword [ebp - 4], ebx
je 0xde5923
and dword [ebp - 0xab0], 0xffffffef
cmp dword [ebp - 0x184], 0x10
jb 0xde5911
mov edx, dword [ebp - 0x198]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x188], ebx
mov byte [ebp - 0x198], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc10]
mov dword [ebp - 0xbfc], esi
mov dword [ebp - 0xc00], ebx
mov byte [ebp - 0xc10], bl
call fcn.00dd4610
push 0x3a
push str.Scan_only_processes_created_N_seconds_before_HH__or_later.
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1c0], ebx
mov byte [ebp - 0x1d0], bl
call fcn.00dd4610
push 6
push str.ptimes
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x41
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], ebx
mov byte [ebp - 0x48c], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0x48c]
push eax
mov byte [ebp - 4], 0x42
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde59d6
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x1d0]
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xc10]
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x478], edi
jb 0xde59f2
mov eax, dword [ebp - 0x48c]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], ebx
mov byte [ebp - 0x48c], bl
cmp dword [ebp - 0x1bc], edi
jb 0xde5a1b
mov ecx, dword [ebp - 0x1d0]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1c0], ebx
mov byte [ebp - 0x1d0], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xbfc], edi
jb 0xde5a47
mov edx, dword [ebp - 0xc10]
push edx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xbfc], esi
mov dword [ebp - 0xc00], ebx
mov byte [ebp - 0xc10], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x43
cmp edi, ebx
je 0xde5ab3
push 7
push str.suspend
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4b0], esi
mov dword [ebp - 0x4b4], ebx
mov byte [ebp - 0x4c4], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x20
push ebx
lea eax, [ebp - 0x4c4]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x44
call fcn.00ddb990
jmp 0xde5ab5
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x45
call fcn.00de2190
test byte [ebp - 0xab0], 0x20
mov dword [ebp - 4], ebx
je 0xde5b05
and dword [ebp - 0xab0], 0xffffffdf
cmp dword [ebp - 0x4b0], 0x10
jb 0xde5af3
mov ecx, dword [ebp - 0x4c4]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x4b0], esi
mov dword [ebp - 0x4b4], ebx
mov byte [ebp - 0x4c4], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xb68]
mov dword [ebp - 0xb54], esi
mov dword [ebp - 0xb58], ebx
mov byte [ebp - 0xb68], bl
call fcn.00dd4610
push 0x29
push str.Suspend_processes_detected_as_suspicious.
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0x46
mov dword [ebp - 0x4e8], esi
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 0x4fc], bl
call fcn.00dd4610
push 7
push str.suspend
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x1f4], esi
mov dword [ebp - 0x1f8], ebx
mov byte [ebp - 0x208], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea edx, [ebp - 0x208]
push edx
mov byte [ebp - 4], 0x48
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde5bb8
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xb68]
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x1f4], edi
jb 0xde5bd4
mov edx, dword [ebp - 0x208]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x1f4], esi
mov dword [ebp - 0x1f8], ebx
mov byte [ebp - 0x208], bl
cmp dword [ebp - 0x4e8], edi
jb 0xde5bfd
mov eax, dword [ebp - 0x4fc]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x4e8], esi
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 0x4fc], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xb54], edi
jb 0xde5c29
mov ecx, dword [ebp - 0xb68]
push ecx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xb54], esi
mov dword [ebp - 0xb58], ebx
mov byte [ebp - 0xb68], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x49
cmp edi, ebx
je 0xde5c95
push 3
push 0xe0ea40
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], ebx
mov byte [ebp - 0x240], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x40
push ebx
lea edx, [ebp - 0x240]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x4a
call fcn.00ddb990
jmp 0xde5c97
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x4b
call fcn.00de2190
test byte [ebp - 0xab0], 0x40
mov dword [ebp - 4], ebx
je 0xde5ce7
and dword [ebp - 0xab0], 0xffffffbf
cmp dword [ebp - 0x22c], 0x10
jb 0xde5cd5
mov eax, dword [ebp - 0x240]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], ebx
mov byte [ebp - 0x240], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 0xc88], esi
mov dword [ebp - 0xc8c], ebx
mov byte [ebp - 0xc9c], bl
call fcn.00dd4610
push 0x24
push str.Append_each_scan_summary_to_the_log.
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], ebx
mov byte [ebp - 0x278], bl
call fcn.00dd4610
push 3
push 0xe0ea40
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0x4d
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x524], ebx
mov byte [ebp - 0x534], bl
call fcn.00dd4610
lea ecx, [ebp - 0x534]
push ecx
mov ecx, dword [ebp - 0xabc]
mov byte [ebp - 4], 0x4e
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde5d9a
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x278]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xc9c]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x520], edi
jb 0xde5db6
mov ecx, dword [ebp - 0x534]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x524], ebx
mov byte [ebp - 0x534], bl
cmp dword [ebp - 0x264], edi
jb 0xde5ddf
mov edx, dword [ebp - 0x278]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], ebx
mov byte [ebp - 0x278], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc88], edi
jb 0xde5e0b
mov eax, dword [ebp - 0xc9c]
push eax
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xc88], esi
mov dword [ebp - 0xc8c], ebx
mov byte [ebp - 0xc9c], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x4f
cmp edi, ebx
je 0xde5e66
push str.kill
lea ecx, [ebp - 0x748]
call fcn.00dd6a40
or dword [ebp - 0xab0], 0x80
push ebx
lea ecx, [ebp - 0x748]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x50
call fcn.00ddb990
jmp 0xde5e68
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x51
call fcn.00de2190
test byte [ebp - 0xab0], 0x80
mov dword [ebp - 4], ebx
je 0xde5ebb
and dword [ebp - 0xab0], 0xffffff7f
cmp dword [ebp - 0x734], 0x10
jb 0xde5ea9
mov edx, dword [ebp - 0x748]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x734], esi
mov dword [ebp - 0x738], ebx
mov byte [ebp - 0x748], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 0xc18], esi
mov dword [ebp - 0xc1c], ebx
mov byte [ebp - 0xc2c], bl
call fcn.00dd4610
push 0x26
push str.Kill_processes_detected_as_suspicious.
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x52
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x2a0], ebx
mov byte [ebp - 0x2b0], bl
call fcn.00dd4610
push 4
push str.kill
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x53
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x55c], ebx
mov byte [ebp - 0x56c], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0x56c]
push eax
mov byte [ebp - 4], 0x54
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde5f6e
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x2b0]
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xc2c]
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x558], edi
jb 0xde5f8a
mov eax, dword [ebp - 0x56c]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x55c], ebx
mov byte [ebp - 0x56c], bl
cmp dword [ebp - 0x29c], edi
jb 0xde5fb3
mov ecx, dword [ebp - 0x2b0]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x2a0], ebx
mov byte [ebp - 0x2b0], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc18], edi
jb 0xde5fdf
mov edx, dword [ebp - 0xc2c]
push edx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xc18], esi
mov dword [ebp - 0xc1c], ebx
mov byte [ebp - 0xc2c], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x55
cmp edi, ebx
je 0xde603a
push str.hooks
lea ecx, [ebp - 0x7f0]
call fcn.00dd6a40
or dword [ebp - 0xab0], 0x100
push ebx
lea eax, [ebp - 0x7f0]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x56
call fcn.00ddb990
jmp 0xde603c
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x57
call fcn.00de2190
test dword [ebp - 0xab0], 0x100
mov dword [ebp - 4], ebx
je 0xde6092
and dword [ebp - 0xab0], 0xfffffeff
cmp dword [ebp - 0x7dc], 0x10
jb 0xde6080
mov ecx, dword [ebp - 0x7f0]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x7dc], esi
mov dword [ebp - 0x7e0], ebx
mov byte [ebp - 0x7f0], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc48]
mov dword [ebp - 0xc34], esi
mov dword [ebp - 0xc38], ebx
mov byte [ebp - 0xc48], bl
call fcn.00dd4610
push 0x2a
push str.Detect_inline_hooks_and_in_memory_patches.
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x58
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d8], ebx
mov byte [ebp - 0x2e8], bl
call fcn.00dd4610
push 5
push str.hooks
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x59
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x594], ebx
mov byte [ebp - 0x5a4], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea edx, [ebp - 0x5a4]
push edx
mov byte [ebp - 4], 0x5a
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde6145
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xc48]
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x590], edi
jb 0xde6161
mov edx, dword [ebp - 0x5a4]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x594], ebx
mov byte [ebp - 0x5a4], bl
cmp dword [ebp - 0x2d4], edi
jb 0xde618a
mov eax, dword [ebp - 0x2e8]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d8], ebx
mov byte [ebp - 0x2e8], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc34], edi
jb 0xde61b6
mov ecx, dword [ebp - 0xc48]
push ecx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xc34], esi
mov dword [ebp - 0xc38], ebx
mov byte [ebp - 0xc48], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x5b
cmp edi, ebx
je 0xde6211
push str.loop
lea ecx, [ebp - 0x7b8]
call fcn.00dd6a40
or dword [ebp - 0xab0], 0x200
push ebx
lea edx, [ebp - 0x7b8]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x5c
call fcn.00ddb990
jmp 0xde6213
xor eax, eax
mov edi, dword [ebp - 0xabc]
push eax
mov ecx, edi
mov dword [ebp - 4], 0x5d
call fcn.00de2190
test dword [ebp - 0xab0], 0x200
mov dword [ebp - 4], ebx
je 0xde626b
and dword [ebp - 0xab0], 0xfffffdff
cmp dword [ebp - 0x7a4], 0x10
jb 0xde6259
mov eax, dword [ebp - 0x7b8]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x7a4], esi
mov dword [ebp - 0x7a8], ebx
mov byte [ebp - 0x7b8], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xbbc]
mov dword [ebp - 0xba8], esi
mov dword [ebp - 0xbac], ebx
mov byte [ebp - 0xbbc], bl
call fcn.00dd4610
push 0x1b
push str.Enable_continuous_scanning.
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x5e
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x310], ebx
mov byte [ebp - 0x320], bl
call fcn.00dd4610
push 4
push str.loop
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x5f
mov dword [ebp - 0x5c8], esi
mov dword [ebp - 0x5cc], ebx
mov byte [ebp - 0x5dc], bl
call fcn.00dd4610
lea ecx, [ebp - 0x5dc]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x60
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde631a
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x320]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xbbc]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x5c8], edi
jb 0xde6336
mov ecx, dword [ebp - 0x5dc]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x5c8], esi
mov dword [ebp - 0x5cc], ebx
mov byte [ebp - 0x5dc], bl
cmp dword [ebp - 0x30c], edi
jb 0xde635f
mov edx, dword [ebp - 0x320]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x310], ebx
mov byte [ebp - 0x320], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xba8], edi
jb 0xde638b
mov eax, dword [ebp - 0xbbc]
push eax
call fcn.00df3292
add esp, 4
push 0xbc
mov dword [ebp - 0xba8], esi
mov dword [ebp - 0xbac], ebx
mov byte [ebp - 0xbbc], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x61
cmp edi, ebx
je 0xde6406
push 0xe0e7dc
lea ecx, [ebp - 0x828]
call fcn.00dd6a40
or dword [ebp - 0xab0], 0x400
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xab8], esp
push str.imprec_mode
mov byte [ebp - 4], 0x62
call fcn.00dd6a40
lea ecx, [ebp - 0x828]
push ecx
mov ecx, edi
call fcn.00de3c10
mov edi, eax
mov dword [ebp - 0xac0], eax
jmp 0xde640e
xor edi, edi
mov dword [ebp - 0xac0], edi
test dword [ebp - 0xab0], 0x400
mov dword [ebp - 4], ebx
je 0xde6451
and dword [ebp - 0xab0], 0xfffffbff
cmp dword [ebp - 0x814], 0x10
jb 0xde643f
mov edx, dword [ebp - 0x828]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x818], ebx
mov byte [ebp - 0x828], bl
cmp edi, ebx
je 0xde65e4
push edi
mov edi, dword [ebp - 0xabc]
mov ecx, edi
call fcn.00de2190
push 0xe0e3d5
lea ecx, [ebp - 0xcf0]
call fcn.00dd6a40
push str.Set_in_which_mode_the_ImportTable_should_be_recovered
lea ecx, [ebp - 0x79c]
mov byte [ebp - 4], 0x64
call fcn.00dd6a40
push 0xe0e7dc
lea ecx, [ebp - 0x764]
mov byte [ebp - 4], 0x65
call fcn.00dd6a40
lea eax, [ebp - 0xcf0]
push eax
lea ecx, [ebp - 0x79c]
push ecx
lea edx, [ebp - 0x764]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x66
call fcn.00ddd8f0
mov edi, 0x10
cmp dword [ebp - 0x750], edi
jb 0xde64db
mov eax, dword [ebp - 0x764]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x750], esi
mov dword [ebp - 0x754], ebx
mov byte [ebp - 0x764], bl
cmp dword [ebp - 0x788], edi
jb 0xde6504
mov ecx, dword [ebp - 0x79c]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x788], esi
mov dword [ebp - 0x78c], ebx
mov byte [ebp - 0x79c], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xcdc], edi
jb 0xde6530
mov edx, dword [ebp - 0xcf0]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xcdc], esi
mov dword [ebp - 0xce0], ebx
mov byte [ebp - 0xcf0], bl
xor edi, edi
lea eax, [ebp - 0x87c]
push edi
push eax
call fcn.00def420
mov dword [ebp - 0xab4], eax
lea ecx, [ebp - 0xa20]
push edi
push ecx
mov byte [ebp - 4], 0x67
call fcn.00def890
add esp, 0x10
mov edx, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xac0]
push edx
push eax
push edi
mov byte [ebp - 4], 0x68
call fcn.00de4960
cmp dword [ebp - 0xa0c], 0x10
jb 0xde659b
mov eax, dword [ebp - 0xa20]
push eax
call fcn.00df3292
add esp, 4
cmp dword [ebp - 0x868], 0x10
mov dword [ebp - 0xa0c], esi
mov dword [ebp - 0xa10], ebx
mov byte [ebp - 0xa20], bl
mov byte [ebp - 4], bl
jb 0xde65c8
mov ecx, dword [ebp - 0x87c]
push ecx
call fcn.00df3292
add esp, 4
inc edi
mov dword [ebp - 0x868], esi
mov dword [ebp - 0x86c], ebx
mov byte [ebp - 0x87c], bl
cmp edi, 6
jb 0xde6544
push 0xbc
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x69
cmp edi, ebx
je 0xde6677
push 7
push str.ofilter
lea ecx, [ebp - 0x614]
mov dword [ebp - 0x600], esi
mov dword [ebp - 0x604], ebx
mov byte [ebp - 0x614], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x800
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 0x6a
mov dword [ebp - 0xab8], esp
jb 0xde664f
mov eax, dword [ecx]
jmp 0xde6651
mov eax, ecx
push 0xa
push str.ofilter_id
mov byte [eax], bl
call fcn.00dd4610
lea edx, [ebp - 0x614]
push edx
mov ecx, edi
call fcn.00de3c10
mov edi, eax
mov dword [ebp - 0xac0], eax
jmp 0xde667f
xor edi, edi
mov dword [ebp - 0xac0], edi
test dword [ebp - 0xab0], 0x800
mov dword [ebp - 4], ebx
je 0xde66c2
and dword [ebp - 0xab0], 0xfffff7ff
cmp dword [ebp - 0x600], 0x10
jb 0xde66b0
mov eax, dword [ebp - 0x614]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x600], esi
mov dword [ebp - 0x604], ebx
mov byte [ebp - 0x614], bl
cmp edi, ebx
je 0xde6896
push edi
mov edi, dword [ebp - 0xabc]
mov ecx, edi
call fcn.00de2190
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0xca4], esi
mov dword [ebp - 0xca8], ebx
mov byte [ebp - 0xcb8], bl
call fcn.00dd4610
push 0x19
push str.Filter_the_dumped_output.
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 0x6c
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 0x64c], bl
call fcn.00dd4610
push 7
push str.ofilter
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x6d
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x348], ebx
mov byte [ebp - 0x358], bl
call fcn.00dd4610
lea ecx, [ebp - 0x358]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x6e
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde6787
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x64c]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xcb8]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x344], edi
jb 0xde67a3
mov ecx, dword [ebp - 0x358]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x348], ebx
mov byte [ebp - 0x358], bl
cmp dword [ebp - 0x638], edi
jb 0xde67cc
mov edx, dword [ebp - 0x64c]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 0x64c], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xca4], edi
jb 0xde67f8
mov eax, dword [ebp - 0xcb8]
push eax
call fcn.00df3292
add esp, 4
mov ecx, dword [ebp - 0xac0]
xor edi, edi
add ecx, 0x8c
mov dword [ebp - 0xca4], esi
mov dword [ebp - 0xca8], ebx
mov byte [ebp - 0xcb8], bl
mov dword [ebp - 0xab8], ecx
mov edi, edi
lea edx, [ebp - 0x8b4]
push edi
push edx
call fcn.00def3a0
add esp, 8
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xab8]
lea eax, [ebp - 0xab4]
push eax
mov byte [ebp - 4], 0x6f
mov dword [ebp - 0xab4], edi
call fcn.00de3b00
mov ecx, dword [ebp - 0xac0]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00dd43f0
cmp dword [ebp - 0x8a0], 0x10
mov byte [ebp - 4], bl
jb 0xde687e
mov edx, dword [ebp - 0x8b4]
push edx
call fcn.00df3292
add esp, 4
inc edi
mov dword [ebp - 0x8a0], esi
mov dword [ebp - 0x8a4], ebx
mov byte [ebp - 0x8b4], bl
cmp edi, 3
jb 0xde6820
push 0xb0
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x70
cmp edi, ebx
je 0xde68f8
push 7
push str.mignore
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0x380], ebx
mov byte [ebp - 0x390], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x1000
push 0x3b
push ebx
lea eax, [ebp - 0x390]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x71
call fcn.00ddba70
jmp 0xde68fa
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x72
call fcn.00de2190
test dword [ebp - 0xab0], 0x1000
mov dword [ebp - 4], ebx
je 0xde6950
and dword [ebp - 0xab0], 0xffffefff
cmp dword [ebp - 0x37c], 0x10
jb 0xde693e
mov ecx, dword [ebp - 0x390]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0x380], ebx
mov byte [ebp - 0x390], bl
push 1
push 3
lea ecx, [ebp - 0x1380]
call fcn.00dde690
lea edx, [ebp - 0x1370]
push str.Do_not_scan_module_s_with_given_name_s.
push edx
mov byte [ebp - 4], 0x73
call fcn.00dd5f20
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x1230]
call fcn.00dde690
push str.user32.dll
push 0x3b
lea eax, [ebp - 0x1220]
push str._t___Example:_kernel32.dll
push eax
mov byte [ebp - 4], 0x74
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd61e0
add esp, 8
push eax
call fcn.00dd5f20
add esp, 8
push 7
push str.mignore
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x674], ebx
mov byte [ebp - 0x684], bl
call fcn.00dd4610
lea ecx, [ebp - 0x924]
push ecx
lea ecx, [ebp - 0x1230]
mov byte [ebp - 4], 0x75
call fcn.00dde7c0
mov dword [ebp - 0xab8], eax
lea edx, [ebp - 0x8ec]
push edx
lea ecx, [ebp - 0x1380]
mov byte [ebp - 4], 0x76
call fcn.00dde7c0
mov dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0x684]
push eax
mov byte [ebp - 4], 0x77
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde6a53
mov ecx, dword [ebp - 0xab4]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
mov edx, dword [ebp - 0xab8]
push 0xffffffffffffffff
push ebx
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x8d8], edi
jb 0xde6a6f
mov eax, dword [ebp - 0x8ec]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x8d8], esi
mov dword [ebp - 0x8dc], ebx
mov byte [ebp - 0x8ec], bl
cmp dword [ebp - 0x910], edi
jb 0xde6a98
mov ecx, dword [ebp - 0x924]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x910], esi
mov dword [ebp - 0x914], ebx
mov byte [ebp - 0x924], bl
cmp dword [ebp - 0x670], edi
jb 0xde6ac1
mov edx, dword [ebp - 0x684]
push edx
call fcn.00df3292
add esp, 4
lea ecx, [ebp - 0x11d0]
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x674], ebx
mov byte [ebp - 0x684], bl
mov byte [ebp - 4], 0x73
call fcn.00dd2fb0
lea eax, [ebp - 0x11d0]
mov edi, vtable.std::ios_base.0
push eax
mov dword [ebp - 0x11d0], edi
call fcn.00df25ba
add esp, 4
lea ecx, [ebp - 0x1320]
mov byte [ebp - 4], bl
call fcn.00dd2fb0
lea ecx, [ebp - 0x1320]
push ecx
mov dword [ebp - 0x1320], edi
call fcn.00df25ba
push 0x7c
call fcn.00df3e67
mov edi, eax
add esp, 8
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x78
cmp edi, ebx
je 0xde6b79
push 5
push str.quiet
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 0x3b4], esi
mov dword [ebp - 0x3b8], ebx
mov byte [ebp - 0x3c8], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x2000
push ebx
lea edx, [ebp - 0x3c8]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x79
call fcn.00ddb990
jmp 0xde6b7b
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x7a
call fcn.00de2190
test dword [ebp - 0xab0], 0x2000
mov dword [ebp - 4], ebx
je 0xde6bd1
and dword [ebp - 0xab0], 0xffffdfff
cmp dword [ebp - 0x3b4], 0x10
jb 0xde6bbf
mov eax, dword [ebp - 0x3c8]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x3b4], esi
mov dword [ebp - 0x3b8], ebx
mov byte [ebp - 0x3c8], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xba0]
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb90], ebx
mov byte [ebp - 0xba0], bl
call fcn.00dd4610
push 0x3d
push str.Print_only_the_summary._Do_not_log_on_stdout_during_the_scan.
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x7b
mov dword [ebp - 0x3ec], esi
mov dword [ebp - 0x3f0], ebx
mov byte [ebp - 0x400], bl
call fcn.00dd4610
push 5
push str.quiet
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x7c
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6ac], ebx
mov byte [ebp - 0x6bc], bl
call fcn.00dd4610
lea ecx, [ebp - 0x6bc]
push ecx
mov ecx, dword [ebp - 0xabc]
mov byte [ebp - 4], 0x7d
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde6c84
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x400]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xba0]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x6a8], edi
jb 0xde6ca0
mov ecx, dword [ebp - 0x6bc]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6ac], ebx
mov byte [ebp - 0x6bc], bl
cmp dword [ebp - 0x3ec], edi
jb 0xde6cc9
mov edx, dword [ebp - 0x400]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x3ec], esi
mov dword [ebp - 0x3f0], ebx
mov byte [ebp - 0x400], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xb8c], edi
jb 0xde6cf5
mov eax, dword [ebp - 0xba0]
push eax
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb90], ebx
mov byte [ebp - 0xba0], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x7e
cmp edi, ebx
je 0xde6d64
push 4
push str.json
lea ecx, [ebp - 0x6f4]
mov dword [ebp - 0x6e0], esi
mov dword [ebp - 0x6e4], ebx
mov byte [ebp - 0x6f4], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x4000
push ebx
lea ecx, [ebp - 0x6f4]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x7f
call fcn.00ddb990
jmp 0xde6d66
xor eax, eax
mov edi, dword [ebp - 0xabc]
push eax
mov ecx, edi
mov dword [ebp - 4], 0x80
call fcn.00de2190
test dword [ebp - 0xab0], 0x4000
mov dword [ebp - 4], ebx
je 0xde6dbe
and dword [ebp - 0xab0], 0xffffbfff
cmp dword [ebp - 0x6e0], 0x10
jb 0xde6dac
mov edx, dword [ebp - 0x6f4]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x6e0], esi
mov dword [ebp - 0x6e4], ebx
mov byte [ebp - 0x6f4], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc64]
mov dword [ebp - 0xc50], esi
mov dword [ebp - 0xc54], ebx
mov byte [ebp - 0xc64], bl
call fcn.00dd4610
push 0x25
push str.Print_the_JSON_report_as_the_summary.
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x81
mov dword [ebp - 0x718], esi
mov dword [ebp - 0x71c], ebx
mov byte [ebp - 0x72c], bl
call fcn.00dd4610
push 4
push str.json
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x82
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], ebx
mov byte [ebp - 0x438], bl
call fcn.00dd4610
lea eax, [ebp - 0x438]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x83
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde6e6d
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x72c]
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xc64]
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x424], edi
jb 0xde6e89
mov eax, dword [ebp - 0x438]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], ebx
mov byte [ebp - 0x438], bl
cmp dword [ebp - 0x718], edi
jb 0xde6eb2
mov ecx, dword [ebp - 0x72c]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x718], esi
mov dword [ebp - 0x71c], ebx
mov byte [ebp - 0x72c], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc50], edi
jb 0xde6ede
mov edx, dword [ebp - 0xc64]
push edx
call fcn.00df3292
add esp, 4
push 0xbc
mov dword [ebp - 0xc50], esi
mov dword [ebp - 0xc54], ebx
mov byte [ebp - 0xc64], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x84
cmp edi, ebx
je 0xde6f83
push 4
push str.jlvl
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x460], ebx
mov byte [ebp - 0x470], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x8000
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 0x85
mov dword [ebp - 0xab8], esp
jb 0xde6f5b
mov eax, dword [ecx]
jmp 0xde6f5d
mov eax, ecx
push 8
push str.json_lvl
mov byte [eax], bl
call fcn.00dd4610
lea eax, [ebp - 0x470]
push eax
mov ecx, edi
call fcn.00de3c10
mov edi, eax
mov dword [ebp - 0xac0], eax
jmp 0xde6f8b
xor edi, edi
mov dword [ebp - 0xac0], edi
test dword [ebp - 0xab0], 0x8000
mov dword [ebp - 4], ebx
je 0xde6fce
and dword [ebp - 0xab0], 0xffff7fff
cmp dword [ebp - 0x45c], 0x10
jb 0xde6fbc
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x460], ebx
mov byte [ebp - 0x470], bl
cmp edi, ebx
je 0xde71bc
push edi
mov edi, dword [ebp - 0xabc]
mov ecx, edi
call fcn.00de2190
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xb30]
mov dword [ebp - 0xb1c], esi
mov dword [ebp - 0xb20], ebx
mov byte [ebp - 0xb30], bl
call fcn.00dd4610
push 0x24
push str.Level_of_details_of_the_JSON_report.
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x87
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x498], ebx
mov byte [ebp - 0x4a8], bl
call fcn.00dd4610
push 4
push str.jlvl
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 0x88
mov dword [ebp - 0x6c4], esi
mov dword [ebp - 0x6c8], ebx
mov byte [ebp - 0x6d8], bl
call fcn.00dd4610
lea edx, [ebp - 0x6d8]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x89
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde7093
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xb30]
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x6c4], edi
jb 0xde70af
mov edx, dword [ebp - 0x6d8]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x6c4], esi
mov dword [ebp - 0x6c8], ebx
mov byte [ebp - 0x6d8], bl
cmp dword [ebp - 0x494], edi
jb 0xde70d8
mov eax, dword [ebp - 0x4a8]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x498], ebx
mov byte [ebp - 0x4a8], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xb1c], edi
jb 0xde7104
mov ecx, dword [ebp - 0xb30]
push ecx
call fcn.00df3292
add esp, 4
mov edx, dword [ebp - 0xac0]
xor edi, edi
add edx, 0x8c
mov dword [ebp - 0xb1c], esi
mov dword [ebp - 0xb20], ebx
mov byte [ebp - 0xb30], bl
mov dword [ebp - 0xab8], edx
lea ebx, [ebx]
lea eax, [ebp - 0xac8]
push eax
lea ecx, [ebp - 0x95c]
push ecx
mov dword [ebp - 0xac8], edi
call fcn.00def680
add esp, 8
mov dword [ebp - 0xac0], eax
mov edx, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xab8]
lea eax, [ebp - 0xab4]
push eax
mov byte [ebp - 4], 0x8a
mov dword [ebp - 0xab4], edx
call fcn.00de3b00
mov ecx, dword [ebp - 0xac0]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00dd43f0
cmp dword [ebp - 0x948], 0x10
mov byte [ebp - 4], bl
jb 0xde71a0
mov edx, dword [ebp - 0x95c]
push edx
call fcn.00df3292
add esp, 4
inc edi
mov dword [ebp - 0x948], esi
mov dword [ebp - 0x94c], ebx
mov byte [ebp - 0x95c], bl
cmp edi, 3
jb 0xde7130
push 0x7c
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x8b
cmp edi, ebx
je 0xde7219
push 7
push str.minidmp
lea ecx, [ebp - 0x5f8]
mov dword [ebp - 0x5e4], esi
mov dword [ebp - 0x5e8], ebx
mov byte [ebp - 0x5f8], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x10000
push ebx
lea eax, [ebp - 0x5f8]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x8c
call fcn.00ddb990
jmp 0xde721b
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x8d
call fcn.00de2190
test dword [ebp - 0xab0], 0x10000
mov dword [ebp - 4], ebx
je 0xde7271
and dword [ebp - 0xab0], 0xfffeffff
cmp dword [ebp - 0x5e4], 0x10
jb 0xde725f
mov ecx, dword [ebp - 0x5f8]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x5e4], esi
mov dword [ebp - 0x5e8], ebx
mov byte [ebp - 0x5f8], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xc80]
mov dword [ebp - 0xc6c], esi
mov dword [ebp - 0xc70], ebx
mov byte [ebp - 0xc80], bl
call fcn.00dd4610
push 0x31
push str.Create_a_minidump_of_the_full_suspicious_process.
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x8e
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x690], ebx
mov byte [ebp - 0x6a0], bl
call fcn.00dd4610
push 7
push str.minidmp
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 0x8f
mov dword [ebp - 0x4cc], esi
mov dword [ebp - 0x4d0], ebx
mov byte [ebp - 0x4e0], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea edx, [ebp - 0x4e0]
push edx
mov byte [ebp - 4], 0x90
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde7324
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xc80]
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x4cc], edi
jb 0xde7340
mov edx, dword [ebp - 0x4e0]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x4cc], esi
mov dword [ebp - 0x4d0], ebx
mov byte [ebp - 0x4e0], bl
cmp dword [ebp - 0x68c], edi
jb 0xde7369
mov eax, dword [ebp - 0x6a0]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x690], ebx
mov byte [ebp - 0x6a0], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc6c], edi
jb 0xde7395
mov ecx, dword [ebp - 0xc80]
push ecx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xc6c], esi
mov dword [ebp - 0xc70], ebx
mov byte [ebp - 0xc80], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x91
cmp edi, ebx
je 0xde7404
push 6
push str.shellc
lea ecx, [ebp - 0x518]
mov dword [ebp - 0x504], esi
mov dword [ebp - 0x508], ebx
mov byte [ebp - 0x518], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x20000
push ebx
lea edx, [ebp - 0x518]
push edx
mov ecx, edi
mov byte [ebp - 4], 0x92
call fcn.00ddb990
jmp 0xde7406
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x93
call fcn.00de2190
test dword [ebp - 0xab0], 0x20000
mov dword [ebp - 4], ebx
je 0xde745c
and dword [ebp - 0xab0], 0xfffdffff
cmp dword [ebp - 0x504], 0x10
jb 0xde744a
mov eax, dword [ebp - 0x518]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x504], esi
mov dword [ebp - 0x508], ebx
mov byte [ebp - 0x518], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xb84]
mov dword [ebp - 0xb70], esi
mov dword [ebp - 0xb74], ebx
mov byte [ebp - 0xb84], bl
call fcn.00dd4610
push 0x29
push str.Detect_shellcode_implants__by_patterns_.
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0x94
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x540], ebx
mov byte [ebp - 0x550], bl
call fcn.00dd4610
push 6
push str.shellc
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x95
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x620], ebx
mov byte [ebp - 0x630], bl
call fcn.00dd4610
lea ecx, [ebp - 0x630]
push ecx
mov ecx, dword [ebp - 0xabc]
mov byte [ebp - 4], 0x96
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde750f
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x550]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xb84]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x61c], edi
jb 0xde752b
mov ecx, dword [ebp - 0x630]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x620], ebx
mov byte [ebp - 0x630], bl
cmp dword [ebp - 0x53c], edi
jb 0xde7554
mov edx, dword [ebp - 0x550]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x540], ebx
mov byte [ebp - 0x550], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xb70], edi
jb 0xde7580
mov eax, dword [ebp - 0xb84]
push eax
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xb70], esi
mov dword [ebp - 0xb74], ebx
mov byte [ebp - 0xb84], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x97
cmp edi, ebx
je 0xde75e0
push 7
push str.threads
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x40000
push ebx
lea ecx, [ebp - 0x80]
push ecx
mov ecx, edi
mov byte [ebp - 4], 0x98
call fcn.00ddb990
jmp 0xde75e2
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x99
call fcn.00de2190
test dword [ebp - 0xab0], 0x40000
mov dword [ebp - 4], ebx
je 0xde7629
and dword [ebp - 0xab0], 0xfffbffff
cmp dword [ebp - 0x6c], 0x10
jb 0xde7620
mov edx, dword [ebp - 0x80]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xae8], ebx
mov byte [ebp - 0xaf8], bl
call fcn.00dd4610
push 0x45
push str.Scan_threads_callstack._Detect_shellcodes__incl._sleeping_beacons.
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x9a
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
call fcn.00dd4610
push 7
push str.threads
lea ecx, [ebp - 0x710]
mov byte [ebp - 4], 0x9b
mov dword [ebp - 0x6fc], esi
mov dword [ebp - 0x700], ebx
mov byte [ebp - 0x710], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0x710]
push eax
mov byte [ebp - 4], 0x9c
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde76dc
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xaf8]
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x6fc], edi
jb 0xde76f8
mov eax, dword [ebp - 0x710]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x6fc], esi
mov dword [ebp - 0x700], ebx
mov byte [ebp - 0x710], bl
cmp dword [ebp - 0x88], edi
jb 0xde7721
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xae4], edi
jb 0xde774d
mov edx, dword [ebp - 0xaf8]
push edx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xae8], ebx
mov byte [ebp - 0xaf8], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0x9d
cmp edi, ebx
je 0xde77bc
push 4
push str.refl
lea ecx, [ebp - 0x588]
mov dword [ebp - 0x574], esi
mov dword [ebp - 0x578], ebx
mov byte [ebp - 0x588], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x80000
push ebx
lea eax, [ebp - 0x588]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x9e
call fcn.00ddb990
jmp 0xde77be
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0x9f
call fcn.00de2190
test dword [ebp - 0xab0], 0x80000
mov dword [ebp - 4], ebx
je 0xde7814
and dword [ebp - 0xab0], 0xfff7ffff
cmp dword [ebp - 0x574], 0x10
jb 0xde7802
mov ecx, dword [ebp - 0x588]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x574], esi
mov dword [ebp - 0x578], ebx
mov byte [ebp - 0x588], bl
push 0x36
push str._t___This_allows_i.e._to_force_read_inaccessible_pages.
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xfc], ebx
mov byte [ebp - 0x10c], bl
call fcn.00dd4610
push 0x26
push str.Make_a_process_reflection_before_scan.
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xa0
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 0xd4], bl
call fcn.00dd4610
push 4
push str.refl
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xa1
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xb8], bl
call fcn.00dd4610
mov ecx, dword [ebp - 0xabc]
lea edx, [ebp - 0xb8]
push edx
mov byte [ebp - 4], 0xa2
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde78c8
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xd4]
push eax
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0xa4], edi
jb 0xde78e4
mov edx, dword [ebp - 0xb8]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xb8], bl
cmp dword [ebp - 0xc0], edi
jb 0xde790d
mov eax, dword [ebp - 0xd4]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 0xd4], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xf8], edi
jb 0xde7939
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.00df3292
add esp, 4
push 0x7c
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xfc], ebx
mov byte [ebp - 0x10c], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0xa3
cmp edi, ebx
je 0xde79a8
push 5
push str.cache
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], ebx
mov byte [ebp - 0x144], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x100000
push ebx
lea edx, [ebp - 0x144]
push edx
mov ecx, edi
mov byte [ebp - 4], 0xa4
call fcn.00ddb990
jmp 0xde79aa
xor eax, eax
mov ecx, dword [ebp - 0xabc]
push eax
mov dword [ebp - 4], 0xa5
call fcn.00de2190
test dword [ebp - 0xab0], 0x100000
mov dword [ebp - 4], ebx
je 0xde7a00
and dword [ebp - 0xab0], 0xffefffff
cmp dword [ebp - 0x130], 0x10
jb 0xde79ee
mov eax, dword [ebp - 0x144]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], ebx
mov byte [ebp - 0x144], bl
push 0x43
push str._t___This_can_speed_up_the_scan__on_the_cost_of_memory_consumption_.
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1dc], ebx
mov byte [ebp - 0x1ec], bl
call fcn.00dd4610
push 0x14
push str.Use_modules_caching.
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0xa6
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x1a4], ebx
mov byte [ebp - 0x1b4], bl
call fcn.00dd4610
push 5
push str.cache
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0xa7
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 0x17c], bl
call fcn.00dd4610
lea ecx, [ebp - 0x17c]
push ecx
mov ecx, dword [ebp - 0xabc]
mov byte [ebp - 4], 0xa8
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde7ab4
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x1b4]
push edx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x168], edi
jb 0xde7ad0
mov ecx, dword [ebp - 0x17c]
push ecx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 0x17c], bl
cmp dword [ebp - 0x1a0], edi
jb 0xde7af9
mov edx, dword [ebp - 0x1b4]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x1a4], ebx
mov byte [ebp - 0x1b4], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0x1d8], edi
jb 0xde7b25
mov eax, dword [ebp - 0x1ec]
push eax
call fcn.00df3292
add esp, 4
push 0xbc
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1dc], ebx
mov byte [ebp - 0x1ec], bl
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0xa9
cmp edi, ebx
je 0xde7bca
push 3
push 0xe0e790
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
mov byte [ebp - 0x224], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x200000
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 0xaa
mov dword [ebp - 0xab8], esp
jb 0xde7ba2
mov eax, dword [ecx]
jmp 0xde7ba4
mov eax, ecx
push 0xd
push str.iat_scan_mode
mov byte [eax], bl
call fcn.00dd4610
lea ecx, [ebp - 0x224]
push ecx
mov ecx, edi
call fcn.00de3c10
mov edi, eax
mov dword [ebp - 0xac0], eax
jmp 0xde7bd2
xor edi, edi
mov dword [ebp - 0xac0], edi
test dword [ebp - 0xab0], 0x200000
mov dword [ebp - 4], ebx
je 0xde7c15
and dword [ebp - 0xab0], 0xffdfffff
cmp dword [ebp - 0x210], 0x10
jb 0xde7c03
mov edx, dword [ebp - 0x224]
push edx
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
mov byte [ebp - 0x224], bl
cmp edi, ebx
je 0xde7de6
push edi
mov edi, dword [ebp - 0xabc]
mov ecx, edi
call fcn.00de2190
push ebx
push 0xe0e3d5
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0xb00], esi
mov dword [ebp - 0xb04], ebx
mov byte [ebp - 0xb14], bl
call fcn.00dd4610
push 0x13
push str.Scan_for_IAT_hooks.
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0xac
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x284], ebx
mov byte [ebp - 0x294], bl
call fcn.00dd4610
push 3
push 0xe0e790
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0xad
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 0x25c], bl
call fcn.00dd4610
lea eax, [ebp - 0x25c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xae
call fcn.00ddbcf0
mov edi, eax
cmp edi, ebx
je 0xde7cda
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [edi + 0x3c]
call fcn.00dd43f0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xb14]
push edx
lea ecx, [edi + 0x58]
call fcn.00dd43f0
mov edi, 0x10
cmp dword [ebp - 0x248], edi
jb 0xde7cf6
mov eax, dword [ebp - 0x25c]
push eax
call fcn.00df3292
add esp, 4
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 0x25c], bl
cmp dword [ebp - 0x280], edi
jb 0xde7d1f
push 0xbc
call fcn.00df3e67
mov edi, eax
add esp, 4
mov dword [ebp - 0xab4], edi
mov byte [ebp - 4], 0xb0
cmp edi, ebx
je 0xde7e79
push 4
push str.dnet
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2bc], ebx
mov byte [ebp - 0x2cc], bl
call fcn.00dd4610
or dword [ebp - 0xab0], 0x400000
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 0xb1
mov dword [ebp - 0xab8], esp
jb 0xde7e51
mov eax, dword [ecx]
jmp 0xde7e53
mov eax, ecx
push 0xd
push str.dotnet_policy
mov byte [eax], bl
call fcn.00dd4610
lea eax, [ebp - 0x2cc]
push eax
mov ecx, edi
call fcn.00de3c10
mov edi, eax
mov dword [ebp - 0xac0], eax
jmp 0xde7e81
xor edi, edi
mov dword [ebp - 0xac0], edi
test dword [ebp - 0xab0], 0x400000
mov dword [ebp - 4], ebx
je 0xde7ec4
and dword [ebp - 0xab0], 0xffbfffff
cmp dword [ebp - 0x2b8], 0x10
jb 0xde7eb2
cmp edi, ebx
je 0xde80ac