Function at 0x100245b1
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Link many functions at runtime

Disassembly:
sub esp, 0xc1c
mov eax, dword [0x10074bac]
xor eax, esp
mov dword [esp + 0xc18], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
cmp dword [0x101434ac], ebx
je 0x100245e3
push str.AttachDetours
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, 0x44c
sub eax, edi
mov dword [0x1029e3f0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0x10144688]
test ecx, 0x400
jne 0x1002462d
cmp byte [0x1013dc03], bl
jne 0x1002462d
test ecx, 0x4000000
je 0x10024628
push ebx
push eax
call fcn.1002bead
pop ecx
pop ecx
test al, al
jne 0x1002462d
call fcn.10034c2c
call esi
sub eax, edi
mov dword [0x1029e3f0], eax
cmp dword [0x101434ac], ebx
je 0x1002464b
push str.AttachDetours2
push ebx
call fcn.1003dfed
pop ecx
pop ecx
call fcn.1002d87f
test al, al
jne 0x1002465b
xor eax, eax
jmp 0x100263f8
push ebp
mov esi, 0x800
push esi
push ebx
push 0x100ee288
call fcn.10040850
push esi
push ebx
push 0x101350b0
call fcn.10040850
mov eax, 0xc45a91b5
mov edi, 0x1ff
push edi
mov dword [0x100ee288], eax
mov dword [0x101350b0], eax
lea eax, [esp + 0x45]
push ebx
push eax
mov dword [0x10072d34], 1
mov byte [esp + 0x4c], bl
call fcn.10040850
mov al, byte [0x102bc54c]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x24
test al, 2
je 0x10024923
push edi
lea eax, [esp + 0x22d]
push ebx
push eax
mov byte [esp + 0x234], bl
call fcn.10040850
push edi
lea eax, [esp + 0x439]
push ebx
push eax
mov byte [esp + 0x440], bl
call fcn.10040850
push edi
lea eax, [esp + 0x845]
push ebx
push eax
mov byte [esp + 0x84c], bl
call fcn.10040850
push edi
lea eax, [esp + 0x651]
push ebx
push eax
mov byte [esp + 0x658], bl
call fcn.10040850
push edi
lea eax, [esp + 0xa5d]
push ebx
push eax
mov byte [esp + 0xa64], bl
call fcn.10040850
add esp, 0x3c
mov edi, 0x1005d458
mov eax, str.__s_12
cmp byte [0x10074b70], bl
jne 0x10024748
mov eax, edi
push str.LhSetExclusiveACL
push eax
lea eax, [esp + 0x230]
push eax
call fcn.10040b98
add esp, 0xc
mov eax, str.__s_16
cmp byte [0x10074b70], bl
jne 0x1002476d
mov eax, edi
push str.LhInstallHook
push eax
lea eax, [esp + 0x430]
push eax
call fcn.10040b98
add esp, 0xc
mov eax, str.__s_0
cmp byte [0x10074b70], bl
jne 0x10024792
mov eax, edi
push str.LhUninstallAllHooks
push eax
lea eax, [esp + 0x830]
push eax
call fcn.10040b98
add esp, 0xc
mov eax, str.__s_0
cmp byte [0x10074b70], bl
jne 0x100247b7
mov eax, edi
push str.LhWaitForPendingRemovals
push eax
lea eax, [esp + 0x630]
push eax
call fcn.10040b98
add esp, 0xc
cmp byte [0x10074b70], bl
je 0x100247da
mov edi, str.__s_28
push str.RhInjectLibrary
lea eax, [esp + 0xa2c]
push edi
push eax
call fcn.10040b98
add esp, 0xc
cmp byte [0x10074b70], bl
je 0x10024812
cmp dword [0x10072cd8], 0x501
jg 0x1002480b
mov eax, str.tcxEZH32.dll
jmp 0x10024828
mov eax, str.tc_EZH32.dll
jmp 0x10024828
cmp dword [0x10072cd8], 0x501
mov eax, str.tcxEZH64.dll
jle 0x10024828
mov eax, str.tc_EZH64.dll
push eax
push 0x10142048
lea eax, [esp + 0x30]
push str._s_s
push eax
call fcn.10040b98
add esp, 0x10
lea eax, [esp + 0x28]
push eax
call ebp
lea ecx, [esp + 0x228]
push ecx
push eax
mov dword [0x1016e8e4], eax
call esi
mov dword [0x1016e8c8], eax
lea eax, [esp + 0x428]
push eax
push dword [0x1016e8e4]
call esi
mov dword [0x1016e8cc], eax
lea eax, [esp + 0x828]
push eax
push dword [0x1016e8e4]
call esi
mov dword [0x1016e8d0], eax
lea eax, [esp + 0x628]
push eax
push dword [0x1016e8e4]
call esi
mov dword [0x1016e8d4], eax
lea eax, [esp + 0xa28]
push eax
push dword [0x1016e8e4]
call esi
mov dword [0x1016e8d8], eax
cmp dword [0x101434ac], ebx
je 0x100248f1
push dword [0x1016e8d4]
lea eax, [esp + 0x2c]
push dword [0x1016e8d0]
push dword [0x1016e8cc]
push dword [0x1016e8c8]
push dword [0x1016e8e4]
push eax
lea eax, [esp + 0x240]
push eax
push str.EZH_Engine_begin__s__s__p__p:_p:_p:_p
push ebx
call fcn.1003dfed
add esp, 0x24
mov dword [0x1014030c], ebx
cmp dword [0x1016e8c8], ebx
je 0x100263e8
cmp dword [0x1016e8cc], ebx
je 0x100263e8
cmp dword [0x1016e8d0], ebx
je 0x100263e8
cmp dword [0x1016e8d8], ebx
jmp 0x10024984
test al, 4
je 0x1002498b
push str.tc_MH.dll
push 0x10142048
lea eax, [esp + 0x30]
push str._s_s
push eax
call fcn.10040b98
add esp, 0x10
lea eax, [esp + 0x28]
push eax
call ebp
push str.CallMe
push eax
mov dword [0x1016e8e8], eax
call esi
mov dword [0x1016e8c0], eax
cmp dword [0x101434ac], ebx
je 0x1002497e
push eax
push dword [0x1016e8e8]
lea eax, [esp + 0x30]
push eax
push str.MH_Engine_begin__s___p___p_
push ebx
call fcn.1003dfed
add esp, 0x14
cmp dword [0x1016e8c0], ebx
jne 0x100249b1
jmp 0x100263e8
cmp dword [0x101434ac], ebx
je 0x100249a0
push str.MS_Engine_begin
push ebx
call fcn.1003dfed
pop ecx
pop ecx
call fcn.10056880
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10057090
cmp dword [0x101434ac], ebx
je 0x100249c6
push str.Engine_launched
push ebx
call fcn.1003dfed
pop ecx
pop ecx
test byte [0x10144ed4], 0x20
je 0x100249d6
mov byte [0x10141c38], 1
cmp dword [0x10140300], 0x20000
jae 0x10024a0b
push 0x10064b38
push 0x10142848
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10024a12
push 0x10143c88
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10024a12
mov byte [0x10141c38], 1
cmp dword [0x1017034c], ebx
jne 0x10024acf
cmp dword [0x10170350], ebx
jne 0x10024acf
push str.Psapi.dll
call ebp
mov edi, eax
mov ebx, str.GetModuleFileNameExA
test edi, edi
je 0x10024a7a
cmp dword [0x1017034c], 0
jne 0x10024a4e
push ebx
push edi
call esi
mov dword [0x1017034c], eax
cmp dword [0x10170350], 0
jne 0x10024a64
push str.GetModuleFileNameExW
push edi
call esi
mov dword [0x10170350], eax
cmp dword [0x10170354], 0
jne 0x10024a7a
push str.GetModuleBaseNameW
push edi
call esi
mov dword [0x10170354], eax
cmp dword [0x1017034c], 0
jne 0x10024acf
cmp dword [0x10170350], 0
jne 0x10024acf
push ebx
mov edi, str.kernel32.dll
push edi
call ebp
push eax
call esi
cmp dword [0x10170350], 0
mov dword [0x1017034c], eax
jne 0x10024ab6
push str.GetModuleFileNameExW
push edi
call ebp
push eax
call esi
mov dword [0x10170350], eax
cmp dword [0x10170354], 0
jne 0x10024acf
push str.GetModuleBaseNameW
push edi
call ebp
push eax
call esi
mov dword [0x10170354], eax
cmp byte [0x10141c38], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, str.ntdll.dll
jne 0x10024c14
push 0x10064afc
push 0x10022bb3
push 0x101a7ef8
call fcn.1000c788
push 0x10064aec
push 0x10022726
push 0x10171a54
call fcn.1000c788
add esp, 0x18
cmp dword [0x102a851c], 0
je 0x10024c14
cmp dword [0x10170364], 0
mov ebx, str.ZwCreateProcess
jne 0x10024b3d
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170364], eax
test eax, eax
je 0x10024b50
push ebx
push 0x10015abe
push 0x10170364
call fcn.1000c788
add esp, 0xc
cmp dword [0x1017036c], 0
jne 0x10024b6d
push str.NtCreateProcess
push edi
call ebp
push eax
call esi
mov dword [0x1017036c], eax
test eax, eax
je 0x10024b84
push str.ntCreateProcess
push 0x10015bb7
push 0x1017036c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170368], 0
mov ebx, str.ZwCreateProcessEx
jne 0x10024ba2
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170368], eax
test eax, eax
je 0x10024bb5
push ebx
push 0x10015b39
push 0x10170368
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170370], 0
jne 0x10024bd2
push str.NtCreateProcessEx
push edi
call ebp
push eax
call esi
mov dword [0x10170370], eax
test eax, eax
je 0x10024be9
push str.ntCreateProcessEx
push 0x10015c32
push 0x10170370
call fcn.1000c788
add esp, 0xc
push 0x10064a6c
push 0x10015cb0
push 0x10171a50
call fcn.1000c788
push 0x10064a58
push 0x10015d13
push 0x10171a40
call fcn.1000c788
add esp, 0x18
cmp dword [0x10140300], 0
jne 0x10024e82
cmp dword [0x10144ec4], 0
jne 0x10024cf2
cmp byte [0x10144ec0], 0
jne 0x10024cf2
cmp dword [0x101434ac], 0
jne 0x10024cf2
test dword [0x10072cd0], 0x8000000
jne 0x10024c64
test dword [0x1013ee8c], 0x20000000
je 0x10024cf2
cmp dword [0x1017037c], 0
mov ebx, str.ZwQuerySystemInformation
jne 0x10024c82
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017037c], eax
test eax, eax
je 0x10024c95
push ebx
push 0x100233cf
push 0x1017037c
call fcn.1000c788
add esp, 0xc
xor ebx, ebx
cmp dword [0x1017034c], ebx
je 0x10024ce6
cmp dword [0x10170350], ebx
je 0x10024ce6
push str.GetModuleFileNameExW
push 0x10023237
push 0x10170350
call fcn.1000c788
push str.GetModuleBaseNameW
push 0x1002334e
push 0x10170354
call fcn.1000c788
push 0x10064a2c
push 0x100232b8
push 0x10072cf0
call fcn.1000c788
add esp, 0x24
cmp dword [0x10140300], ebx
jne 0x10024e82
test dword [0x10072cd0], 0x10000000
jne 0x10024d0e
test dword [0x1013ee8c], 0x20000000
je 0x10024e22
push 0x10142848
call fcn.1002b9b4
pop ecx
test al, al
jne 0x10024d35
cmp byte [0x10144ec0], al
jne 0x10024d35
test dword [0x10072cd0], 0x20000000
je 0x10024e18
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x10024e18
push 0x400
call fcn.10040c33
mov dword [esp], 0x10064a24
push eax
mov dword [esp + 0x24], eax
call fcn.100074ff
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
mov ecx, dword [eax]
xor ebx, ebx
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push dword [esp + 0x28]
push ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10024e0c
cmp dword [esp + 0x18], ebx
je 0x10024e02
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push 0x1006d33c
push ebx
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x10024e02
mov eax, dword [esp + 0x24]
mov dword [0x1016e6ac], eax
cmp eax, ebx
je 0x10024e02
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0x20
push ebx
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x10024e02
mov eax, dword [esp + 0x20]
mov dword [0x1016e6b0], eax
cmp eax, ebx
je 0x10024e02
cmp dword [0x1016ecf4], ebx
jne 0x10024deb
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [0x1016ecf4], eax
cmp eax, ebx
je 0x10024e02
push str.IEnumIDList_Next
push 0x10018796
push 0x1016ecf4
call fcn.1000c788
add esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x1c]
call fcn.10040b8d
pop ecx
jmp 0x10024e1a
xor ebx, ebx
cmp dword [0x10140300], ebx
jne 0x10024e82
test dword [0x10072cd0], 0x2000000
jne 0x10024e3a
test dword [0x10072cc8], 0x8000
je 0x10024e82
push 0x10064a00
push 0x100170a9
push 0x1019fd68
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170308], 0
mov ebx, str.ZwEnumerateKey
jne 0x10024e6f
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170308], eax
test eax, eax
je 0x10024e82
push ebx
push 0x10016df8
push 0x10170308
call fcn.1000c788
add esp, 0xc
test dword [0x10140b8c], 0x100000
jne 0x100263df
push str.Mswsock.dll
call ebp
mov ebx, eax
test ebx, ebx
je 0x10024ecb
cmp dword [0x1016e8dc], 0
jne 0x10024eb5
push str.TransmitFile
push ebx
call esi
mov dword [0x1016e8dc], eax
cmp dword [0x1016e8e0], 0
jne 0x10024ecb
push str.TransmitPackets
push ebx
call esi
mov dword [0x1016e8e0], eax
xor ebx, ebx
cmp dword [0x1016e8dc], ebx
je 0x10024eec
push str.TransmitFile
push 0x10012811
push 0x1016e8dc
call fcn.1000c788
add esp, 0xc
cmp dword [0x1016e8e0], ebx
je 0x10024f0b
push str.TransmitPackets
push 0x10012a0e
push 0x1016e8e0
call fcn.1000c788
add esp, 0xc
push str.bind
push 0x1001278d
push 0x10196484
call fcn.1000c788
push str.inet_ntoa
push 0x100127cd
push 0x10171a10
call fcn.1000c788
push str.send
push 0x10012b64
push 0x1019f004
call fcn.1000c788
push 0x100649a8
push 0x10012cdd
push 0x101a7edc
call fcn.1000c788
push str.sendto
push 0x10012e4a
push 0x1019fd74
call fcn.1000c788
push 0x10064994
push 0x10012f78
push 0x101a7f20
call fcn.1000c788
add esp, 0x48
test dword [0x101446a0], 0x1000
jne 0x10024fa9
push str.socket
push 0x1001258f
push 0x101a7eb8
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170374], ebx
jne 0x10024fd9
mov ebx, str.ZwTerminateProcess
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170374], eax
test eax, eax
je 0x10024fd9
push ebx
push 0x1001325a
push 0x10170374
call fcn.1000c788
add esp, 0xc
test byte [0x10072cdc], 1
je 0x10025947
push 0x10064964
push 0x1001e021
push 0x1019fd84
call fcn.1000c788
add esp, 0xc
cmp dword [0x1017032c], 0
jne 0x1002502e
mov ebx, str.ZwDeleteFile
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017032c], eax
test eax, eax
je 0x1002502e
push ebx
push 0x1001e1e8
push 0x1017032c
call fcn.1000c788
add esp, 0xc
cmp dword [0x1017031c], 0
mov ebx, str.ZwOpenFile
jne 0x1002505f
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017031c], eax
test eax, eax
je 0x1002505f
push ebx
push 0x1001d94f
push 0x1017031c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170328], 0
mov ebx, str.ZwCreateFile
jne 0x10025090
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170328], eax
test eax, eax
je 0x10025090
push ebx
push 0x1001e2f6
push 0x10170328
call fcn.1000c788
add esp, 0xc
cmp dword [0x102a851c], 0
je 0x10025160
test dword [0x101446a0], 0x10000
jne 0x10025160
cmp dword [0x10144ecc], 3
jne 0x10025160
push str.memcpy
push 0x1001252d
push 0x10072cf4
call fcn.1000c788
push str.wmemcpy
push 0x10012565
push 0x10072cf8
call fcn.1000c788
push str.memcpy_s
push 0x1001256b
push 0x10072cfc
call fcn.1000c788
push str.wmemcpy_s
push 0x10012571
push 0x10072d00
call fcn.1000c788
push str.strcpy
push 0x10012577
push 0x10072d04
call fcn.1000c788
push str.wcscpy
push 0x1001257d
push 0x10072d08
call fcn.1000c788
add esp, 0x48
push str.strcpy_s
push 0x10012583
push 0x10072d0c
call fcn.1000c788
push str.wcscpy_s
push 0x10012589
push 0x10072d10
call fcn.1000c788
add esp, 0x18
push 0x100648dc
push 0x1001b194
push 0x101a7f1c
call fcn.1000c788
add esp, 0xc
cmp byte [0x102bc549], 0
je 0x100251b8
cmp dword [0x10141be4], 0
jne 0x100251a1
push str.CreateFile2
push str.Kernel32.dll
call ebp
push eax
call esi
mov dword [0x10141be4], eax
test eax, eax
je 0x100251b8
push str.CreateFile2
push 0x1001a807
push 0x10141be4
call fcn.1000c788
add esp, 0xc
cmp byte [0x1013dc00], 0
jne 0x100251ea
cmp dword [0x10144ec4], 0xa
je 0x100251ea
test dword [0x10144688], 0x20000000
jne 0x100251ea
push 0x1006280c
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10025216
cmp dword [0x10170328], 0
jne 0x10025216
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170328], eax
test eax, eax
je 0x10025216
push ebx
push 0x1001e2f6
push 0x10170328
call fcn.1000c788
add esp, 0xc
xor eax, eax
cmp dword [0x10144ec4], eax
je 0x100252a4
test dword [0x101446a0], 0x80000000
jne 0x100252a4
test dword [0x10144ef4], 0x200000
je 0x100252a4
cmp dword [0x101434ac], eax
je 0x10025251
push 0x100648ac
push eax
call fcn.1003dfed
pop ecx
pop ecx
push 0x10064890
push 0x1001312d
push 0x10072d28
call fcn.1000c788
push 0x10064880
push 0x1001316e
push 0x10072d2c
call fcn.1000c788
push 0x10064874
push 0x100130a1
push 0x10171a3c
call fcn.1000c788
push 0x10064860
push 0x100131d9
push 0x1019eff8
call fcn.1000c788
add esp, 0x30
test dword [0x101446a0], 0x80000000
mov ebx, str.ZwOpenKey
jne 0x100257a4
cmp byte [0x10072497], 0
je 0x10025359
cmp byte [0x101400f7], 0
je 0x10025359
xor eax, eax
cmp dword [0x10140300], eax
jne 0x10025359
cmp dword [0x10144ec4], eax
jne 0x10025359
cmp byte [0x10144ec0], al
jne 0x10025359
test dword [0x1013ee94], 0x400
je 0x10025359
cmp dword [0x1017030c], eax
jne 0x10025359
push ebx
push edi
call ebp
push eax
call esi
push str.ZwOpenKeyEx
push edi
mov dword [0x1017030c], eax
call ebp
push eax
call esi
cmp dword [0x1017030c], 0
mov dword [0x10170310], eax
je 0x10025339
push ebx
push 0x10017346
push 0x1017030c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170310], 0
je 0x10025359
push str.ZwOpenKeyEx
push 0x100174af
push 0x10170310
call fcn.1000c788
add esp, 0xc
test dword [0x101446a0], 0x80000000
jne 0x100257a4
cmp byte [0x10072497], 0
je 0x100257a4
cmp byte [0x100724b3], 0
je 0x100257a4
push 0x10064834
push 0x10017af1
push 0x1019fd7c
call fcn.1000c788
push 0x10064824
push 0x10017c2c
push 0x10171a1c
call fcn.1000c788
push 0x10064810
push 0x10017d3f
push 0x10171a30
call fcn.1000c788
push 0x10064800
push 0x10017df1
push 0x10171a44
call fcn.1000c788
add esp, 0x30
cmp dword [0x10140300], 0x10000
jae 0x10025419
test dword [0x1013ee94], 0x80000
je 0x10025419
push str.ZwSetValueKey
push edi
call ebp
push eax
call esi
mov dword [0x10171a04], eax
test eax, eax
je 0x10025419
push str.ZwSetValueKey
push 0x10018fcc
push 0x10171a04
call fcn.1000c788
add esp, 0xc
test dword [0x1013ee94], 0x280000
je 0x10025464
push 0x100647e0
push 0x10013650
push 0x101a7ec4
call fcn.1000c788
push 0x100647d0
push 0x100134dc
push 0x10196480
call fcn.1000c788
push 0x100647c0
push 0x10013825
push 0x1019f018
call fcn.1000c788
add esp, 0x24
cmp dword [0x102a851c], 0
jne 0x10025494
cmp dword [0x10140300], 0
jne 0x100257a4
cmp dword [0x10144ec4], 0
jne 0x100257a4
cmp byte [0x10144ec0], 0
jne 0x100257a4
test dword [0x1013ee94], 0x400
je 0x10025501
cmp dword [0x1017030c], 0
jne 0x10025501
push ebx
push edi
call ebp
push eax
call esi
push str.ZwOpenKeyEx
push edi
mov dword [0x1017030c], eax
call ebp
push eax
call esi
cmp dword [0x1017030c], 0
mov dword [0x10170310], eax
je 0x100254e1
push ebx
push 0x10017346
push 0x1017030c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170310], 0
je 0x10025501
push str.ZwOpenKeyEx
push 0x100174af
push 0x10170310
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170318], 0
mov ebx, str.ZwQueryDirectoryFile
jne 0x1002551f
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170318], eax
test eax, eax
je 0x10025532
push ebx
push 0x10017826
push 0x10170318
call fcn.1000c788
add esp, 0xc
mov ebx, str.ZwClose
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170320], eax
test eax, eax
je 0x1002555a
push ebx
push 0x10017809
push 0x10170320
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170328], 0
jne 0x1002558b
mov ebx, str.ZwCreateFile
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170328], eax
test eax, eax
je 0x1002558b
push ebx
push 0x1001e2f6
push 0x10170328
call fcn.1000c788
add esp, 0xc
cmp dword [0x1017031c], 0
mov ebx, str.ZwOpenFile
jne 0x100255bc
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017031c], eax
test eax, eax
je 0x100255bc
push ebx
push 0x1001d94f
push 0x1017031c
call fcn.1000c788
add esp, 0xc
cmp dword [0x102a851c], 0
je 0x100257a4
cmp dword [0x1017031c], 0
jne 0x100255f5
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017031c], eax
test eax, eax
je 0x100255f5
push ebx
push 0x1001d94f
push 0x1017031c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170334], 0
mov ebx, str.ZwOpenDirectoryObject
jne 0x10025613
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170334], eax
test eax, eax
je 0x10025626
push ebx
push 0x10017e93
push 0x10170334
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170340], 0
mov ebx, str.FindFirstFileTransactedW
mov edi, str.Kernel32.dll
jne 0x10025649
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170340], eax
test eax, eax
je 0x1002565c
push ebx
push 0x10018009
push 0x10170340
call fcn.1000c788
add esp, 0xc
cmp dword [0x1017033c], 0
mov ebx, str.FindFirstFileNameW
jne 0x1002567a
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x1017033c], eax
test eax, eax
je 0x1002568d
push ebx
push 0x10018161
push 0x1017033c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170338], 0
mov ebx, str.FindFirstFileNameTransactedW
jne 0x100256ab
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170338], eax
test eax, eax
je 0x100256be
push ebx
push 0x10018299
push 0x10170338
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170344], 0
mov ebx, str.FindFirstStreamTransactedW
jne 0x100256dc
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170344], eax
test eax, eax
je 0x100256ef
push ebx
push 0x100183e2
push 0x10170344
call fcn.1000c788
add esp, 0xc
cmp dword [0x10170348], 0
mov ebx, str.FindFirstStreamW
jne 0x1002570d
push ebx
push edi
call ebp
push eax
call esi
mov dword [0x10170348], eax
test eax, eax
je 0x10025720
push ebx
push 0x10018520
push 0x10170348
call fcn.1000c788
add esp, 0xc
push 0x100646f8
push 0x10018909
push 0x10171a08
call fcn.1000c788
add esp, 0xc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, str.InitiateShutdownW
test eax, eax
je 0x1002575d
cmp dword [0x101703d8], 0
jne 0x10025766
push edi
push eax
call esi
mov dword [0x101703d8], eax
cmp dword [0x101703d8], 0
je 0x10025779
push edi
push 0x10018949
push 0x101703d8
call fcn.1000c788
add esp, 0xc
push 0x100646bc
push 0x1001898c
push 0x101a7f28
call fcn.1000c788
push 0x100646a0
push 0x100189d8
push 0x101a7eb0
call fcn.1000c788
add esp, 0x18
push str.Secur32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov edi, str.EncryptMessage
cmp eax, ebx
je 0x100257cb
cmp dword [0x10170390], ebx
jne 0x100257d3
push edi
push eax
call esi
mov dword [0x10170390], eax
cmp dword [0x10170390], ebx
je 0x100257e0
push edi
push 0x100167d2
push 0x10170390
jmp 0x1002581d
cmp dword [0x10144ecc], 1
jne 0x10025825
push str.nspr4.dll
call ebp
mov edi, str.PR_Write
cmp eax, ebx
je 0x1002580a
cmp dword [0x10171a18], ebx
jne 0x10025812
push edi
push eax
call esi
mov dword [0x10171a18], eax
cmp dword [0x10171a18], ebx
je 0x10025825
push edi
push 0x10016c52
push 0x10171a18
call fcn.1000c788
add esp, 0xc
push str.nss3.dll
call ebp
mov edi, str.PK11_Encrypt
cmp eax, ebx
je 0x10025846
cmp dword [0x1019fd6c], ebx
jne 0x1002584e
push edi
push eax
call esi
mov dword [0x1019fd6c], eax
cmp dword [0x1019fd6c], ebx
je 0x10025861
push edi
push 0x100166ae
push 0x1019fd6c
call fcn.1000c788
add esp, 0xc
cmp byte [0x10144ec0], 0
mov edi, str.Oleacc.dll
mov ebx, str.AccessibleObjectFromEvent
jne 0x100258cd
push 0x10064618
push 0x10018ceb
push 0x1019fd78
call fcn.1000c788
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100258a8
cmp dword [0x10141c00], 0
jne 0x100258b1
push ebx
push eax
call esi
mov dword [0x10141c00], eax
cmp dword [0x10141c00], 0
je 0x100258cd
cmp dword [0x101434ac], 0
je 0x100258c8
push str.InitializeWindowEventHook4URL
push 0
call fcn.1003dfed
pop ecx
pop ecx
call fcn.10031156
cmp dword [0x1029e3f8], 8
jne 0x10025947
test dword [0x101446a0], 0x2000000
jne 0x10025947
cmp dword [0x10072cbc], 0
je 0x10025947
cmp dword [0x101434ac], 0x777
jne 0x10025905
push str.g_MessengerType__MSG_LYNC2
push 0
call fcn.1003dfed
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10025922
cmp dword [0x10141c00], 0
jne 0x1002592b
push ebx
push eax
call esi
mov dword [0x10141c00], eax
cmp dword [0x10141c00], 0
je 0x10025947
cmp dword [0x101434ac], 0
je 0x10025942
push str.InitializeWindowEventHook4URL
push 0
call fcn.1003dfed
pop ecx
pop ecx
call fcn.10031156
test byte [0x10072cdc], 2
je 0x10025a4d
cmp dword [0x10144ec4], 0
jne 0x10025a22
cmp dword [0x10144ecc], 0
jne 0x10025a22
push str.connect
push 0x1001601f
push 0x10171a24
call fcn.1000c788
push 0x100645c4
push 0x10016084
push 0x10171a2c
call fcn.1000c788
add esp, 0x18
cmp dword [0x10072cd8], 0x500
mov ebx, str.IcmpSendEcho2
jne 0x100259b1
push str.Icmp.dll
jmp 0x100259b6
push str.Iphlpapi.dll
call ebp
mov edi, eax
test edi, edi
je 0x100259e6
cmp dword [0x10141bdc], 0
jne 0x100259d4
push str.IcmpSendEcho
push edi
call esi
mov dword [0x10141bdc], eax
cmp dword [0x10141be0], 0
jne 0x100259e6
push ebx
push edi
call esi
mov dword [0x10141be0], eax
cmp dword [0x10141bdc], 0
je 0x10025a06
push str.IcmpSendEcho
push 0x100160fd
push 0x10141bdc
call fcn.1000c788
add esp, 0xc
cmp dword [0x10141be0], 0
je 0x10025a22
push ebx
push 0x1001616f
push 0x10141be0
call fcn.1000c788
add esp, 0xc
test byte [0x1015bd84], 0x10
je 0x10025a4d
push str.packet.dll
call ebp
test eax, eax
je 0x10025a4d
push 0x10062130
push 0x10010e8d
push 0x1019efd0
call fcn.1000c788
add esp, 0xc
test byte [0x10072cdc], 1
je 0x100263df
push 0x1006457c
push 0x1001c62b
push 0x1019fd80
call fcn.1000c788
push 0x10064570
push 0x1001c863
push 0x101a7f08
call fcn.1000c788
push 0x10064564
push 0x1001c004
push 0x10171a34
call fcn.1000c788
push 0x10064558
push 0x1001c263
push 0x1019f010
call fcn.1000c788
add esp, 0x30
cmp byte [0x102bc549], 0
je 0x10025aeb
cmp dword [0x10141be8], 0
mov edi, str.CopyFile2
jne 0x10025ad8
push edi
push str.Kernel32.dll
call ebp
push eax
call esi
mov dword [0x10141be8], eax
test eax, eax
je 0x10025aeb
push edi
push 0x1001c3f2
push 0x10141be8
call fcn.1000c788
add esp, 0xc
push 0x10064540
push 0x1001ce07
push 0x10196490
call fcn.1000c788
push 0x10064534
push 0x1001d0ba
push 0x10196494
call fcn.1000c788
push 0x10064528
push 0x1001c9cb
push 0x101a7ee4
call fcn.1000c788
push 0x1006451c
push 0x1001cc55
push 0x10171a6c
call fcn.1000c788
push 0x100624c8
push 0x1001d558
push 0x1019f9bc
call fcn.1000c788
push 0x10062464
push 0x1001d28d
push 0x101a7ef0
call fcn.1000c788
mov edi, 0x600
add esp, 0x48
cmp dword [0x10072cd8], edi
jge 0x10025b9e
push 0x10064508
push 0x1001bdb7
push 0x10171a4c
call fcn.1000c788
push 0x100644f4
push 0x1001bb57
push 0x1019f9b4
call fcn.1000c788
add esp, 0x18
xor ebx, ebx
cmp dword [0x10140300], ebx
jne 0x100263df
cmp dword [0x10072cd8], edi
jl 0x10025ea9
test byte [0x1013ee94], 8
jne 0x10025be4
cmp byte [0x10144ec0], bl
jne 0x10025be4
push 0x10142848
call fcn.1002b7e4
pop ecx
test al, al
jne 0x10025be4
cmp dword [0x10144ec4], ebx
je 0x10025ea9
cmp byte [0x10072496], 0
je 0x10025ea9
cmp dword [0x10072cbc], ebx
jne 0x10025c06
cmp byte [0x10144691], 0
je 0x10025ea9
push 0
mov byte [0x101400f4], 1
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x10141b98
push 0x1005ed78
push 1
push 0
push 0x1005ed68
call ebx
test eax, eax
jl 0x10025ea9
mov eax, dword [0x10141b98]
test eax, eax
je 0x10025ea9
mov ecx, dword [0x101703a4]
xor edi, edi
mov dword [0x1016e6a0], eax
cmp ecx, edi
jne 0x10025c61
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x40]
mov dword [0x101703a4], ecx
cmp dword [0x101703a8], edi
jne 0x10025c74
mov edx, dword [eax]
mov edx, dword [edx + 0x44]
mov dword [0x101703a8], edx
cmp dword [0x101703ac], edi
jne 0x10025c87
mov edx, dword [eax]
mov edx, dword [edx + 0x30]
mov dword [0x101703ac], edx
cmp dword [0x101703b0], edi
jne 0x10025c9a
mov edx, dword [eax]
mov edx, dword [edx + 0x34]
mov dword [0x101703b0], edx
cmp dword [0x101703b4], edi
jne 0x10025cad
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
mov dword [0x101703b4], edx
cmp dword [0x101703b8], edi
jne 0x10025cc0
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
mov dword [0x101703b8], edx
cmp dword [0x101703bc], edi
jne 0x10025cd3
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
mov dword [0x101703bc], edx
cmp dword [0x101703c0], edi
jne 0x10025ce5
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
mov dword [0x101703c0], eax
cmp ecx, edi
je 0x10025d00
push str.CopyItem
push 0x10024155
push 0x101703a4
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703a8], edi
je 0x10025d1f
push str.CopyItems
push 0x100240e1
push 0x101703a8
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703ac], edi
je 0x10025d3e
push str.RenameItem
push 0x10023f60
push 0x101703ac
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703b0], edi
je 0x10025d5d
push str.RenameItems
push 0x10023eec
push 0x101703b0
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703b4], edi
je 0x10025d7c
push str.MoveItem
push 0x10024054
push 0x101703b4
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703b8], edi
je 0x10025d9b
push str.MoveItems
push 0x10023fe0
push 0x101703b8
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703bc], edi
je 0x10025dba
push str.DeleteItem
push 0x10023e5f
push 0x101703bc
call fcn.1000c788
add esp, 0xc
cmp dword [0x101703c0], edi
je 0x10025dd9
push str.DeleteItems
push 0x10023dde
push 0x101703c0
call fcn.1000c788
add esp, 0xc
mov eax, dword [0x10141b98]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test dword [0x101446a0], 0x4000000
jne 0x10025ea9
cmp dword [0x10170398], 0
mov edi, str.SHCreateStreamOnFileEx
jne 0x10025e1e
push edi
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [0x10170398], eax
test eax, eax
je 0x10025ea9
push 0x10141b94
push 0x1005ed98
push 1
push 0
push 0x1005ed88
call ebx
test eax, eax
mov eax, dword [0x10141b94]
jl 0x10025e61
test eax, eax
je 0x10025e61
mov ecx, dword [0x10141b90]
test ecx, ecx
jne 0x10025e52
mov ecx, eax
mov dword [0x10141b90], ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x10025e61
mov ecx, dword [ecx + 0x1c]
mov dword [0x1017039c], ecx
cmp dword [0x1017039c], 0
je 0x10025e9f
cmp dword [0x10170398], 0
je 0x10025e9f
push edi
push 0x1001a298
push 0x10170398
call fcn.1000c788
push str.IPortableDeviceValuesSetStringValue
push 0x1001a051
push 0x1017039c
call fcn.1000c788
mov eax, dword [0x10141b94]
add esp, 0x18
test eax, eax
je 0x10025ea9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test byte [0x10072cdc], 1
je 0x10026012
test byte [0x102bc54c], 2
jne 0x10025f7c
test dword [0x101446a0], 0x400000
jne 0x10025f7c
xor eax, eax
cmp dword [0x10144ec4], eax
jne 0x10025f7c
cmp dword [0x10144ecc], eax
jne 0x10025f7c
cmp byte [0x10144ec0], al
jne 0x10025f7c
cmp dword [0x10144ec8], eax
jne 0x10025f7c
push 0x10064440
push 0x10023101
push 0x101a7ec8
call fcn.1000c788
push 0x10064434
push 0x100163ce
push 0x101a7ee0
call fcn.1000c788
push 0x1006442c
push 0x1001630a
push 0x101a7eec
call fcn.1000c788
push 0x10064420
push 0x10016370
push 0x10171a64
call fcn.1000c788
push 0x1006440c
push 0x10016486
push 0x1019f014
call fcn.1000c788
push 0x10064400
push 0x1001644f
push 0x10171a20
call fcn.1000c788
add esp, 0x48
mov ebx, 0x4000000
mov edi, 0x10142848
test dword [0x101446a0], ebx
jne 0x10025fe5
push 0x1005fee0
push edi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10025fbb
push 0x100643f0
push 0x100112d3
push 0x101a7ecc
call fcn.1000c788
add esp, 0xc
jmp 0x100263df
test dword [0x101446a0], ebx
jne 0x10025fe5
test dword [0x1014469c], ebx
jne 0x10025fe5
test byte [0x1013f2e4], 2
je 0x10025fe5
push 0x100643e0
push 0x1001119a
push 0x1019f9b0
jmp 0x10025fae
push str._nc.exe
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10026017
push 0x100643d4
push 0x10021bbd
push 0x101a7f18
call fcn.1000c788
add esp, 0xc
jmp 0x10026017
mov edi, 0x10142848
push str.TEAMVIEWER.EXE
push edi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002603f
push 0x100643f0
push 0x100112d3
push 0x101a7ecc
call fcn.1000c788
add esp, 0xc
push edi
call fcn.1002b9b4
pop ecx
test al, al
jne 0x10026056
test dword [0x10072cd0], 0x20000000
je 0x100260ba
push 0x10064874
push 0x100130a1
push 0x10171a3c
call fcn.1000c788
add esp, 0xc
test dword [0x10072cd0], 0x20000000
je 0x100260ba
push str.NetStat.exe
push edi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x100260ba
push 0x100643b8
push 0x10016638
push 0x101a7ec0
call fcn.1000c788
push 0x100643a8
push 0x1001650c
push 0x10171a48
call fcn.1000c788
add esp, 0x18
jmp 0x100263df
test byte [0x101446a0], 2
jne 0x1002612c
push 0x1006439c
push 0x100243df
push 0x1019efec
call fcn.1000c788
push 0x10064390
push 0x10018a27
push 0x101a7eb4
call fcn.1000c788
add esp, 0x18
push str.Netapi32.dll
call ebp
mov dword [0x10141c0c], eax
test eax, eax
je 0x1002612c
cmp dword [0x10170358], 0
mov edi, str.NetUserChangePassword
jne 0x10026119
push edi
push eax
call esi
mov dword [0x10170358], eax
test eax, eax
je 0x1002612c
push edi
push 0x100241e2
push 0x10170358
call fcn.1000c788
add esp, 0xc
test dword [0x101446a0], 0x10000000
mov ebx, 0x10021d14
mov edi, 0x10171a68
jne 0x10026166
test dword [0x1015bd84], 0x100
jne 0x10026166
cmp dword [0x10144ec4], 0
je 0x10026166
push 0x10064358
push ebx
push edi
call fcn.1000c788
add esp, 0xc
test dword [0x101446a0], 0x2000000
jne 0x1002618a
test byte [0x1029e3f8], 0xe
je 0x1002618a
push 0x10064358
push ebx
push edi
call fcn.1000c788
add esp, 0xc
test byte [0x10072cdc], 1
mov edi, 0x10064348
mov ebx, 0x4000
je 0x1002637d
test dword [0x101446a0], ebx
jne 0x1002637d
push 0x1006433c
push 0x10013b24
push 0x101a7ee8
call fcn.1000c788
push 0x10064334
push 0x10014973
push 0x1019efd8
call fcn.1000c788
push 0x10064440
push 0x10023101
push 0x101a7ec8
call fcn.1000c788
add esp, 0x24
cmp byte [0x10144ec2], 0
je 0x1002626c
test dword [0x1014469c], ebx
je 0x1002637d
cmp byte [0x10144693], 0
jne 0x1002637d
cmp byte [0x10144ec0], 0
jne 0x1002637d
push str.Spoolss.dll
call ebp
mov dword [0x10141c10], eax
test eax, eax
je 0x1002637d
cmp dword [0x10141bec], 0
mov byte [0x1013eeb7], 0
jne 0x1002637d
push edi
push eax
call esi
mov dword [0x10141bec], eax
test eax, eax
je 0x1002637d
push edi
push 0x10013997
push 0x10072d18
call fcn.1000c788
add esp, 0xc
jmp 0x1002637d
cmp byte [0x10144ec0], 0
jne 0x10026378
cmp byte [0x10144693], 0
jne 0x10026378
xor ebx, ebx
cmp dword [0x10141c10], ebx
jne 0x10026378
cmp dword [0x10141bec], ebx
jne 0x10026378
push str.winspool.drv
call ebp
mov dword [0x10141c14], eax
cmp eax, ebx
je 0x10026378
mov byte [0x1013eeb7], bl
cmp dword [0x10141bec], ebx
jne 0x100262e2
push edi
push eax
call esi
mov dword [0x10141bec], eax
cmp eax, ebx
je 0x100262e2
push edi
push 0x10013997
push 0x10072d18
call fcn.1000c788
add esp, 0xc
cmp dword [0x10141bf0], ebx
jne 0x10026314
mov ebp, 0x10064304
push ebp
push dword [0x10141c14]
call esi
mov dword [0x10141bf0], eax
cmp eax, ebx
je 0x10026314
push ebp
push 0x10013a53
push 0x10072d1c
call fcn.1000c788
add esp, 0xc
cmp dword [0x10141bf4], ebx
jne 0x10026346
mov ebp, 0x100642f0
push ebp
push dword [0x10141c14]
call esi
mov dword [0x10141bf4], eax
cmp eax, ebx
je 0x10026346
push ebp
push 0x10013c2e
push 0x10072d20
call fcn.1000c788
add esp, 0xc
cmp dword [0x10141bf8], ebx
jne 0x10026378
mov ebp, 0x100642e0
push ebp
push dword [0x10141c14]
call esi
mov dword [0x10141bf8], eax
cmp eax, ebx
je 0x10026378
push ebp
push 0x10013ca8
push 0x10072d24
call fcn.1000c788
add esp, 0xc
mov ebx, 0x4000
test byte [0x10148b1c], 3
jne 0x10026396
test dword [0x1014469c], ebx
jne 0x100263df
test dword [0x101446a0], ebx
jne 0x100263df
push edi
push 0x10013997
push 0x10072d18
mov byte [0x1013dc02], 1
mov byte [0x1013eeb7], 0
call fcn.1000c788
push 0x100642d8
push 0x100148cc
push 0x1019f9b8
call fcn.1000c788
push 0x100642cc
push 0x1001482d
push 0x10171a60
call fcn.1000c788
add esp, 0x24
test byte [0x102bc54c], 1
jne 0x100263ed
xor eax, eax
inc eax
jmp 0x100263f7
lea eax, [esp + 0x10]
push eax
call fcn.10056ae0
pop ebp
mov ecx, dword [esp + 0xc24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004083f
add esp, 0xc1c
ret