Function at 0x1002a02f
Capabilities:
Resume thread

Disassembly:
mov eax, 0x101358ff
call fcn.1007db34
sub esp, 0x570
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x28]
xor edi, edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x6c], edi
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x6c]
push ecx
push eax
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
mov dword [ebp - 4], edi
call fcn.1002f4c9
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.10094cc0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x38], edi
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
mov byte [ebp - 4], 3
call fcn.1002f696
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.10094cc0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x30], edi
call fcn.1008f010
cmp dword [ebp + 0xc], edi
mov byte [ebp - 4], 6
mov ebx, 0x101ad1f8
jne 0x1002a11c
push edi
mov ecx, ebx
call fcn.1004bccb
test eax, eax
je 0x1002a11c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 7
call fcn.1002f8a9
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.10094cc0
cmp dword [ebp - 0x30], edi
je 0x1002a110
push dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
call fcn.1008fc80
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10094cc0
push 4
lea ecx, [ebp - 0x7c]
call fcn.1005eb25
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0xa
cmp eax, edi
mov esi, 0x101ad158
je 0x1002a15d
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnCreateProcessA___App:_S___Cmd:_S_____S_
push 0x101786b8
push 4
call fcn.1007bb15
add esp, 0x1c
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 6
call fcn.1005eb48
mov ecx, esi
call fcn.10057e76
test eax, eax
je 0x1002a1d3
mov ecx, esi
call fcn.10057c87
test eax, eax
je 0x1002a1d3
push str.._
push 0x101786a8
lea ecx, [ebp - 0x18]
call fcn.10091770
test eax, eax
je 0x1002a19c
mov dword [ebp - 0x30], 1
mov esi, 0x10160a78
push 0x10160a84
push esi
lea ecx, [ebp - 0x4c]
call fcn.10096c00
test eax, eax
je 0x1002a1ba
mov dword [ebp - 0x6c], 1
push 0x10160a84
push esi
lea ecx, [ebp - 0x34]
call fcn.10096c00
test eax, eax
je 0x1002a1d3
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], edi
push eax
call fcn.100011ce
test eax, eax
pop ecx
je 0x1002a389
test byte [ebp - 0x68], 1
je 0x1002a389
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
mov dword [ebp + 8], edi
mov dword [ebp - 0x3c], edi
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x2c], eax
je 0x1002a2d1
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x30], edi
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x1002a24f
mov eax, dword [ebp + 0x10]
jmp 0x1002a25d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], edi
mov dword [ebp + 0x10], eax
jne 0x1002a26a
mov eax, dword [ebp + 0xc]
jmp 0x1002a282
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
call fcn.1008f1e0
mov dword [ebp - 0x14], 1
mov eax, dword [eax]
mov byte [ebp - 4], 0xb
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push esi
call dword [ebp - 0x2c]
test byte [ebp - 0x14], 1
mov dword [ebp - 4], 6
je 0x1002a2b7
lea ecx, [ebp - 0x48]
call fcn.1008f940
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xc], eax
jmp 0x1002a372
mov ebx, dword [esi + 0x18]
cmp ebx, edi
je 0x1002a372
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x30], edi
jne 0x1002a2ef
mov eax, dword [ebp + 0x10]
jmp 0x1002a2fd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], edi
mov dword [ebp + 0x10], eax
jne 0x1002a30a
mov eax, dword [ebp + 0xc]
jmp 0x1002a322
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.1008f1e0
mov dword [ebp - 0x14], 2
mov eax, dword [eax]
mov byte [ebp - 4], 0xc
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ebx
test byte [ebp - 0x14], 2
mov ebx, eax
mov dword [ebp - 4], 6
je 0x1002a357
lea ecx, [ebp - 0x1c]
call fcn.1008f940
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x1002a372
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x30], edi
je 0x1002a381
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100906a0
mov esi, dword [esi + 0x14]
jmp 0x1002ae57
and byte [ebp - 0x194], 0
and dword [ebp - 0x24], 0
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
push 4
lea ecx, [ebp - 0x64]
call fcn.1005eb25
push dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.100943c0
push dword [ebp + 0xc]
mov esi, dword [eax]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
call fcn.100943c0
mov eax, dword [eax]
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.1004ee2f
test eax, eax
jne 0x1002a3e7
call fcn.100511e1
test eax, eax
jne 0x1002a40d
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x1002a407
mov ecx, ebx
call fcn.1004dc65
neg eax
sbb al, al
inc al
mov byte [ebp - 0x1d], al
jne 0x1002a40d
and byte [ebp - 0x1d], 0
jmp 0x1002a411
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
call fcn.10094cc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.10094cc0
cmp byte [ebp - 0x1d], 0
je 0x1002a481
lea eax, [ebp - 0x194]
push 0x104
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1002b9e7
add esp, 0x10
test eax, eax
je 0x1002a47a
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x1c]
push eax
call fcn.100943c0
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x10
call fcn.1004f0fe
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xd
call fcn.10094cc0
jmp 0x1002a481
mov dword [ebp - 0x24], 2
push dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
call fcn.100943c0
mov esi, dword [eax]
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.100943c0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
push esi
push eax
mov byte [ebp - 4], 0x12
call fcn.1002fa4b
lea ecx, [ebp - 0x1c]
mov esi, eax
mov byte [ebp - 4], 0x11
call fcn.10094cc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.10094cc0
xor ebx, ebx
mov byte [ebp - 4], 6
cmp esi, ebx
lea ecx, [ebp - 0x64]
je 0x1002a508
call fcn.1005eb48
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.1008f940
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10094cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10094cc0
xor eax, eax
jmp 0x1002ae7d
call fcn.1005eb48
cmp dword [ebp - 0x24], ebx
jne 0x1002a6c5
push 1
lea ecx, [ebp - 0x10]
call fcn.10001261
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 0x13
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
mov edi, dword [esi + 0x20]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x1002a601
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x30], 0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x1002a581
mov eax, dword [ebp + 0x10]
jmp 0x1002a58f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], 0
mov dword [ebp + 0x10], eax
jne 0x1002a59d
mov eax, dword [ebp + 0xc]
jmp 0x1002a5b5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.1008f1e0
mov dword [ebp - 0x14], 4
mov eax, dword [eax]
mov byte [ebp - 4], 0x14
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push esi
call dword [ebp - 0x1c]
test byte [ebp - 0x14], 4
mov dword [ebp - 4], 0x13
je 0x1002a5ea
lea ecx, [ebp - 0x2c]
call fcn.1008f940
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x20], edi
mov dword [esi + 0xc], eax
jmp 0x1002a6a1
mov edi, dword [esi + 0x18]
test edi, edi
je 0x1002a6a1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x30], 0
jne 0x1002a620
mov ebx, dword [ebp + 0x10]
jmp 0x1002a630
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
push dword [eax - 8]
call fcn.100905d0
mov ebx, eax
cmp dword [ebp - 0x38], 0
jne 0x1002a63b
mov eax, dword [ebp + 0xc]
jmp 0x1002a653
push dword [ebp - 0x34]
lea ecx, [ebp + 0x10]
call fcn.1008f1e0
mov dword [ebp - 0x14], 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x15
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push eax
call edi
test byte [ebp - 0x14], 8
mov ebx, eax
mov dword [ebp - 4], 0x13
je 0x1002a686
lea ecx, [ebp + 0x10]
call fcn.1008f940
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x1002a6a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x30], 0
je 0x1002a6b1
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100906a0
mov esi, dword [esi + 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.1000127e
jmp 0x1002ae57
push 0x101aad04
lea ecx, [ebp - 0x10]
call fcn.1008f010
push 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x16
call fcn.1005eb25
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x17
push dword [ebp + 0xc]
push eax
call fcn.1002c7bb
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x18
call fcn.1008fac0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x17
call fcn.1008f940
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x1002a725
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x10]
call fcn.1008fac0
jmp 0x1002a73a
cmp dword [ebp - 0x30], ebx
je 0x1002a72f
lea eax, [ebp - 0x18]
jmp 0x1002a71a
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.1008fba0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x16
call fcn.1005eb48
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.100943c0
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x10]
push eax
mov byte [ebp - 4], 0x19
call fcn.100943c0
push dword [ebp - 0x28]
mov eax, dword [eax]
mov esi, 0x101aa510
mov byte [ebp - 4], 0x1a
push eax
mov ecx, esi
call fcn.1000a658
lea ecx, [ebp + 0x10]
mov edi, eax
mov byte [ebp - 4], 0x19
call fcn.10094cc0
cmp edi, ebx
je 0x1002a7b6
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
mov dword [ebp + 0x10], ebx
push dword [ebp - 0x28]
call fcn.1000a694
cmp dword [ebp + 0x10], ebx
je 0x1002a7b6
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.1008fc80
push dword [ebp + 0x10]
call fcn.1007de95
pop ecx
push 1
lea ecx, [ebp - 0x78]
call fcn.10001261
and dword [ebp - 0x5c], 0
xor eax, eax
lea edi, [ebp - 0x58]
mov esi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x74], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp + 0x20]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push edi
or ebx, 4
call fcn.1005e85a
mov eax, dword [ebp + 0x10]
add esp, 0x10
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x1002a8b8
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x38], 0
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x1002a836
mov eax, dword [ebp + 0xc]
jmp 0x1002a851
push dword [ebp - 0x34]
lea ecx, [ebp - 0x84]
call fcn.1008f1e0
mov dword [ebp - 0x14], 0x10
mov eax, dword [eax]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
push ecx
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x2c]
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 8]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.100905d0
push eax
push dword [ebp - 0x2c]
push esi
call dword [ebp - 0x1c]
test byte [ebp - 0x14], 0x10
mov dword [ebp - 4], 0x1b
je 0x1002a89e
and dword [ebp - 0x14], 0xffffffef
lea ecx, [ebp - 0x84]
call fcn.1008f940
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x60]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0xc], eax
jmp 0x1002a953
mov eax, dword [esi + 0x18]
test eax, eax
mov dword [ebp - 0x40], eax
je 0x1002a953
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x38], 0
jne 0x1002a8da
mov edi, dword [ebp + 0xc]
jmp 0x1002a8f2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x60]
call fcn.1008f1e0
mov dword [ebp - 0x14], 0x20
mov edi, dword [eax]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x10]
push dword [ebp + 0x2c]
mov eax, dword [eax - 8]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.100905d0
push eax
push edi
call dword [ebp - 0x40]
test byte [ebp - 0x14], 0x20
mov edi, eax
mov dword [ebp - 4], 0x1b
je 0x1002a938
and dword [ebp - 0x14], 0xffffffdf
lea ecx, [ebp - 0x60]
call fcn.1008f940
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x1002a953
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100906a0
cmp dword [ebp - 0x30], 0
je 0x1002a96d
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100906a0
mov eax, dword [esi + 0x14]
push 4
lea ecx, [ebp - 0x8c]
mov dword [ebp + 0x2c], eax
call fcn.1005eb25
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0x1e
test eax, eax
je 0x1002aa0b
cmp dword [ebp - 0x38], 0
jne 0x1002a9aa
push dword [ebp + 0xc]
lea ecx, [ebp + 0x24]
call fcn.100943c0
or dword [ebp - 0x14], 0x40
mov edi, dword [eax]
mov byte [ebp - 4], 0x1f
jmp 0x1002a9ad
mov edi, dword [ebp - 0x34]
push dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
call fcn.100943c0
mov ebx, eax
mov dword [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebx]
push edi
push 0x8d8
push str._CSafeInject::OnCreateProcessA__Line:_d_appname__s__NewCmdLine__s__CurrentDirectory__s__Ret__d__error__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x24
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x1f
call fcn.10094cc0
test byte [ebp - 0x14], 0x40
mov dword [ebp - 4], 0x1e
je 0x1002aa0b
lea ecx, [ebp + 0x24]
call fcn.10094cc0
cmp dword [ebp + 0x2c], 0
je 0x1002ae21
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x24]
push eax
call fcn.100943c0
push dword [eax]
mov edi, 0x101ad1f8
mov ecx, edi
mov byte [ebp - 4], 0x21
call fcn.10050190
test eax, eax
jne 0x1002aa86
mov ecx, edi
call fcn.1004ed3e
test eax, eax
jne 0x1002aa82
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x1002aa86
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x10]
push eax
call fcn.100943c0
mov eax, dword [eax]
push str.ReaderHostU.exe
push eax
call fcn.1007edba
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp + 0x10]
setne bl
call fcn.10094cc0
test bl, bl
je 0x1002aa86
mov bl, 1
jmp 0x1002aa88
xor bl, bl
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
test bl, bl
je 0x1002aace
push dword [ebp - 0x4c]
push 1
push dword [ebp - 0x54]
call fcn.10052dd3
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.1007c2fd
lea eax, [ebp - 0x54]
push 1
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x22
call fcn.1007d10b
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.1007c326
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x10]
push eax
call fcn.100943c0
push dword [ebp - 0x54]
mov eax, dword [eax]
mov ecx, edi
mov byte [ebp - 4], 0x23
push eax
call fcn.1004cf1a
lea ecx, [ebp + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
test esi, esi
je 0x1002ab6c
lea ecx, [ebp - 0x44]
call fcn.1007c2fd
lea eax, [ebp - 0x54]
push 1
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x24
call fcn.1007d10b
cmp dword [0x101b04b8], 0
je 0x1002ab60
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x10]
push eax
call fcn.100943c0
push dword [ebp - 0x54]
mov byte [ebp - 4], 0x25
push dword [eax]
push 0x8ea
push str._CSafeInject::OnCreateProcessA__Line:_d_FileDevice_Allow_it...Proc__s__PID__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x18
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x24
call fcn.10094cc0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.1007c326
lea eax, [ebp + 0x28]
and dword [ebp + 0x28], 0
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x5c]
call fcn.10027369
add esp, 0xc
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x1002ab8f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
mov esi, 0x101aad04
call fcn.100ab010
test eax, eax
pop ecx
je 0x1002abad
cmp dword [ebp - 0x24], 4
je 0x1002abb3
and dword [ebp - 0x24], 0
jmp 0x1002abb3
mov esi, dword [0x101ad644]
push esi
lea ecx, [ebp + 0x24]
call fcn.100943c0
mov eax, dword [eax]
push 0
push eax
mov byte [ebp - 4], 0x26
call fcn.1007344b
mov ebx, eax
pop ecx
neg ebx
pop ecx
mov byte [ebp - 4], 0x1e
sbb bl, bl
lea ecx, [ebp + 0x24]
inc bl
call fcn.10094cc0
test bl, bl
je 0x1002abe8
and dword [ebp - 0x24], 0
xor ebx, ebx
xor edi, edi
call fcn.100bc6f0
test eax, eax
je 0x1002ac00
push str.tsysdrv.dll
call fcn.100d6050
pop ecx
mov eax, dword [ebp - 0x24]
cmp eax, 1
jne 0x1002ac16
push esi
push dword [ebp - 0x58]
push dword [ebp + 0x10]
call fcn.100d7160
jmp 0x1002ac44
cmp eax, 2
je 0x1002ac31
cmp eax, 4
jne 0x1002ac34
push esi
push dword [ebp - 0x54]
call fcn.10059a8e
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x1002ac49
push ebx
jmp 0x1002ac3b
cmp eax, 3
jne 0x1002ac49
push 1
push esi
push dword [ebp + 0x10]
call fcn.100d7370
add esp, 0xc
mov edi, eax
cmp dword [0x101b04b8], ebx
je 0x1002ac7b
lea eax, [ebp - 0x194]
mov ecx, 0x101ad158
push eax
push edi
push dword [ebp - 0x24]
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnCreateProcessA___Type:_d__Inject__d____s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x1c
mov ecx, 0x101ad158
call fcn.10057df6
test eax, eax
je 0x1002adec
cmp dword [ebp + 0xc], 0
je 0x1002adec
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.100943c0
push dword [eax]
mov byte [ebp - 4], 0x27
call fcn.10057a13
pop ecx
cmp eax, 0x310
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x1e
sete bl
call fcn.10094cc0
test bl, bl
je 0x1002adec
mov ecx, 0x101ad158
call fcn.100aa440
push eax
lea ecx, [ebp + 0xc]
call fcn.10094520
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0x28
test eax, eax
mov ebx, str.SafeDoc
je 0x1002ad07
push dword [ebp + 0xc]
push 0x945
push str._CSafeInject::OnCreateProcessA__Line:_d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
mov edx, dword [ebp + 0xc]
cmp dword [edx - 8], 0
je 0x1002ade0
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], esi
stosd dword es:[edi], eax
mov ecx, 0xf9
lea edi, [ebp - 0x57a]
mov word [ebp - 0x57c], si
push 0x1f3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x57c]
push edx
push eax
call fcn.1007e246
lea eax, [ebp - 0x44]
push 2
push eax
lea eax, [ebp - 0x57c]
push eax
call fcn.100271ef
add esp, 0x18
cmp eax, 2
jne 0x1002adc2
cmp dword [0x101b04b8], esi
je 0x1002ad84
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x957
push str._CSafeInject::OnCreateProcessA__Line:_d__Cmd1__s___Cmd2__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x18
push dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
call fcn.1002c5b0
mov edi, eax
push edi
push dword [ebp - 0x54]
call fcn.1000a24d
cmp dword [0x101b04b8], esi
pop ecx
pop ecx
je 0x1002ade0
push dword [ebp + 0xc]
push dword [ebp - 0x54]
push edi
push 0x95e
push str._CSafeInject::OnCreateProcessA__Line:_d__Enable__d__PID__d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x1002ade0
cmp dword [0x101b04b8], esi
je 0x1002ade0
push eax
push 0x952
push str._CSafeInject::OnCreateProcessA__Line:_d__iCount__d_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
cmp dword [ebp + 0x28], 0
je 0x1002adfb
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 0x20], 4
jne 0x1002ae0a
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp + 0x30], 0
je 0x1002ae21
lea eax, [ebp - 0x5c]
push 0x10
push eax
push dword [ebp + 0x30]
call fcn.1007dea0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x1b
call fcn.1005eb48
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x19
call fcn.1000127e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
call fcn.10094cc0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.1008f940
mov esi, dword [ebp + 0x2c]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.1008f940
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10094cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10094cc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x2c