Function at 0x10003bf0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x448
mov eax, dword [esp + 0x460]
cmp eax, 1
je 0x10003c12
test eax, eax
jne 0x10004b83
xor ecx, ecx
int 0x29
push str.left4dead2.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004ab6
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ebp, [eax + 0x24e0]
lea ebx, [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 0x40
push 1
push ebp
call edi
mov byte [esi + 0x24e0], 0xc3
push ebx
push dword [esp + 0x18]
push 1
push ebp
call edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Storm
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x100096d8
push str.CONOUT_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfreopen]
add esp, 0xc
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
movsd xmm0, qword [0x100092b0]
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0xc0000
movsd xmm0, qword [0x100092c0]
movsd qword [esp + 0x20], xmm0
lea eax, [esp + 0x28]
push str.Terminal
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
add esp, 8
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
movsd xmm0, qword [0x100092d0]
movsd qword [esp + 0xc], xmm0
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea eax, [esp + 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 4], 0
movsx eax, word [esp + 0x240]
movsx ecx, word [esp + 0x242]
imul ecx, eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push ecx
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.engine.dll
call esi
mov dword [0x1000b0e4], eax
push str.client.dll
call esi
mov dword [0x1000b370], eax
and byte [eax + 0x7b053c], 0xf5
mov eax, dword [0x1000b370]
and dword [eax + 0x7807cc], 0xfffffff5
mov eax, dword [0x1000b370]
and dword [eax + 0x77e36c], 0xfffffff5
push str.server.dll
call esi
and byte [eax + 0x7f7ae4], 0xf5
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x310a42]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov dword [ebp + 0x310a42], 0xe70480d9
mov word [ebp + 0x310a46], 0xffd4
push edi
push dword [esp + 4]
push 6
push ebx
call esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
push str._____Extend_Interface
call esi
add esp, 4
call fcn.10001000
push str._____Events
call esi
add esp, 4
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17b9e0]
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b3b4], eax
mov ecx, dword [ebp + 0x17b9e0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b9e4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3b4]
mov ecx, dword [ebp + 0x17b9e6]
mov dword [eax + 6], ecx
mov eax, dword [0x1000b3b4]
mov byte [eax + 0xa], 0x68
lea eax, [ebp + 0x17b9ea]
mov ecx, dword [0x1000b3b4]
mov dword [ecx + 0xb], eax
mov eax, dword [0x1000b3b4]
mov byte [eax + 0xf], 0xc3
push edi
push 0x40
push 0x10
push dword [0x1000b3b4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
push ebx
call esi
mov byte [ebp + 0x17b9e0], 0x68
mov dword [ebp + 0x17b9e1], 0x10001280
mov byte [ebp + 0x17b9e5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebx
call esi
mov ebp, dword [0x1000b0e4]
lea ebx, [ebp + 0x7f54d]
push edi
push 0x40
push 1
push ebx
call esi
mov byte [ebp + 0x7f54d], 0xeb
push edi
push dword [esp + 4]
push 1
push ebx
call esi
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1000b370], eax
push str._____Interpolation
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call eax
add esp, 4
mov ebp, dword [0x1000b370]
lea edi, [ebp + 0x344f0]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x1000b3b8], eax
mov ecx, dword [ebp + 0x344f0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x344f4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3b8]
lea ecx, [ebp + 0x344f6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b3b8]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b3b8]
mov byte [eax + 0xb], 0xc3
mov ebx, esp
push ebx
push 0x40
push 0xc
push dword [0x1000b3b8]
call esi
push ebx
push 0x40
push 6
push edi
call esi
mov byte [ebp + 0x344f0], 0x68
mov dword [ebp + 0x344f1], 0x10001320
mov byte [ebp + 0x344f5], 0xc3
push ebx
push dword [esp + 4]
push 6
push edi
call esi
mov edi, esi
push str._____Animations
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x4c230]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b3bc], eax
mov ecx, dword [ebp + 0x4c230]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x4c234]
mov word [eax + 4], cx
mov eax, dword [0x1000b3bc]
lea ecx, [ebp + 0x4c236]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b3bc]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b3bc]
mov byte [eax + 0xb], 0xc3
mov esi, esp
push esi
push 0x40
push 0xc
push dword [0x1000b3bc]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x4c230], 0x68
mov dword [ebp + 0x4c231], 0x10001340
mov byte [ebp + 0x4c235], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x3bdf0]
push esi
push 0x40
push 3
push ebx
call edi
mov word [ebp + 0x3bdf0], 0x18c2
mov byte [ebp + 0x3bdf2], 0
push esi
push dword [esp + 4]
push 3
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x3163f3]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x3163f3], 0xf
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x3164a6]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x3164a6], 0xf
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17b3b0]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b4e8], eax
mov ecx, dword [ebp + 0x17b3b0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b3b4]
mov word [eax + 4], cx
mov eax, dword [0x1000b4e8]
lea ecx, [ebp + 0x17b3b6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b4e8]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b4e8]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b4e8]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x17b3b0], 0x68
mov dword [ebp + 0x17b3b1], 0x10003be0
mov byte [ebp + 0x17b3b5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17c407]
push esi
push 0x40
push 8
push ebx
call edi
mov dword [ebp + 0x17c40b], 0x90909090
mov dword [ebp + 0x17c407], 0x90909090
push esi
push dword [esp + 4]
push 8
push ebx
call edi
mov esi, edi
push str._____Prediction
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov eax, dword [0x1000b370]
movups xmm0, xmmword [eax + 0x6f1f0c]
movups xmmword [0x1000b4ec], xmm0
movsd xmm0, qword [eax + 0x6f1f1c]
movsd qword [0x1000b4fc], xmm0
mov dword [eax + 0x6f1f0c], 0x1000b000
mov dword [eax + 0x6f1f10], 1
mov dword [eax + 0x6f1f18], 0x1000b4ec
mov ebp, dword [0x1000b0e4]
lea ebx, [ebp + 0x80ce0]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x1000b3e4], eax
mov ecx, dword [ebp + 0x80ce0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x80ce4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3e4]
lea ecx, [ebp + 0x80ce6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b3e4]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b3e4]
mov byte [eax + 0xb], 0xc3
mov edi, esp
push edi
push 0x40
push 0xc
push dword [0x1000b3e4]
call esi
push edi
push 0x40
push 6
push ebx
call esi
mov byte [ebp + 0x80ce0], 0x68
mov dword [ebp + 0x80ce1], 0x10001530
mov byte [ebp + 0x80ce5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebx
call esi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17c3e0]
push 0xe
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b3e8], eax
mov ecx, dword [ebp + 0x17c3e0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17c3e4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3e8]
movzx ecx, word [ebp + 0x17c3e6]
mov word [eax + 6], cx
mov eax, dword [0x1000b3e8]
mov byte [eax + 8], 0x68
lea eax, [ebp + 0x17c3e8]
mov ecx, dword [0x1000b3e8]
mov dword [ecx + 9], eax
mov eax, dword [0x1000b3e8]
mov byte [eax + 0xd], 0xc3
push edi
push 0x40
push 0xe
push dword [0x1000b3e8]
call esi
push edi
push 0x40
push 6
push ebx
call esi
mov byte [ebp + 0x17c3e0], 0x68
mov dword [ebp + 0x17c3e1], 0x10001570
mov byte [ebp + 0x17c3e5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebx
call esi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17b7b0]
push edi
push 0x40
push 1
push ebx
call esi
mov byte [ebp + 0x17b7b0], 0xeb
push edi
push dword [esp + 4]
push 1
push ebx
call esi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17c460]
push edi
push 0x40
push 1
push ebx
call esi
mov byte [ebp + 0x17c460], 0xeb
push edi
push dword [esp + 4]
push 1
push ebx
call esi
mov ebx, esi
mov ebp, dword [0x1000b370]
lea esi, [ebp + 0xeeda0]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x1000b3ec], eax
mov ecx, dword [ebp + 0xeeda0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0xeeda4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3ec]
lea ecx, [ebp + 0xeeda6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b3ec]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b3ec]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x1000b3ec]
call ebx
mov eax, ebx
push edi
mov ebx, edi
push 0x40
push 6
push esi
mov edi, eax
call eax
mov byte [ebp + 0xeeda0], 0x68
mov dword [ebp + 0xeeda1], 0x10001620
mov byte [ebp + 0xeeda5], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x17b2c0]
push 0xe
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b3f0], eax
mov ecx, dword [ebp + 0x17b2c0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b2c4]
mov word [eax + 4], cx
mov eax, dword [0x1000b3f0]
movzx ecx, word [ebp + 0x17b2c6]
mov word [eax + 6], cx
mov eax, dword [0x1000b3f0]
mov byte [eax + 8], 0x68
lea eax, [ebp + 0x17b2c8]
mov ecx, dword [0x1000b3f0]
mov dword [ecx + 9], eax
mov eax, dword [0x1000b3f0]
mov byte [eax + 0xd], 0xc3
mov eax, esp
push eax
push 0x40
push 0xe
push dword [0x1000b3f0]
call edi
mov esi, esp
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x17b2c0], 0x68
mov dword [ebp + 0x17b2c1], 0x10001640
mov byte [ebp + 0x17b2c5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebx, dword [0x1000b370]
lea ebp, [ebx + 0x26b150]
push 0xf
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b3f4], eax
mov ecx, dword [ebx + 0x26b150]
mov dword [eax], ecx
movzx ecx, word [ebx + 0x26b154]
mov word [eax + 4], cx
mov eax, dword [0x1000b3f4]
movzx ecx, word [ebx + 0x26b156]
mov word [eax + 6], cx
movzx ecx, byte [ebx + 0x26b158]
mov byte [eax + 8], cl
mov eax, dword [0x1000b3f4]
mov byte [eax + 9], 0x68
lea eax, [ebx + 0x26b159]
mov ecx, dword [0x1000b3f4]
mov dword [ecx + 0xa], eax
mov eax, dword [0x1000b3f4]
mov byte [eax + 0xe], 0xc3
push esi
push 0x40
push 0xf
push dword [0x1000b3f4]
call edi
push esi
push 0x40
push 6
push ebp
call edi
mov byte [ebx + 0x26b150], 0x68
mov dword [ebx + 0x26b151], 0x10001690
mov byte [ebx + 0x26b155], 0xc3
push esi
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, dword [0x1000b370]
mov ecx, dword [0x1000b3f4]
sub eax, ecx
add eax, 0x2533d7
mov dword [ecx + 5], eax
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x2f18a0]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b400], eax
mov ecx, dword [ebp + 0x2f18a0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x2f18a4]
mov word [eax + 4], cx
mov eax, dword [0x1000b400]
lea ecx, [ebp + 0x2f18a6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b400]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b400]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b400]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x2f18a0], 0x68
mov dword [ebp + 0x2f18a1], 0x10001790
mov byte [ebp + 0x2f18a5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea eax, [ebp + 0x310a37]
mov dword [0x1000b404], eax
lea ebx, [ebp + 0x310a2e]
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x310a2e], 0x68
mov dword [ebp + 0x310a2f], 0x100017c0
mov byte [ebp + 0x310a33], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
push str._____Network
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x1000b0e4]
lea ebx, [ebp + 0x79db0]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x1000b408], eax
mov ecx, dword [ebp + 0x79db0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x79db4]
mov word [eax + 4], cx
mov eax, dword [0x1000b408]
lea ecx, [ebp + 0x79db6]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b408]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b408]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b408]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x79db0], 0x68
mov dword [ebp + 0x79db1], 0x100017e0
mov byte [ebp + 0x79db5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebx, dword [0x1000b0e4]
lea ebp, [ebx + 0x7d060]
push 0xf
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b410], eax
mov ecx, dword [ebx + 0x7d060]
mov dword [eax], ecx
movzx ecx, word [ebx + 0x7d064]
mov word [eax + 4], cx
mov eax, dword [0x1000b410]
movzx ecx, word [ebx + 0x7d066]
mov word [eax + 6], cx
movzx ecx, byte [ebx + 0x7d068]
mov byte [eax + 8], cl
mov eax, dword [0x1000b410]
mov byte [eax + 9], 0x68
lea eax, [ebx + 0x7d069]
mov ecx, dword [0x1000b410]
mov dword [ecx + 0xa], eax
mov eax, dword [0x1000b410]
mov byte [eax + 0xe], 0xc3
push esi
push 0x40
push 0xf
push dword [0x1000b410]
call edi
push esi
push 0x40
push 6
push ebp
call edi
mov byte [ebx + 0x7d060], 0x68
mov dword [ebx + 0x7d061], 0x10001810
mov byte [ebx + 0x7d065], 0xc3
push esi
push dword [esp + 4]
push 6
push ebp
call edi
push 0x100096dc
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x1314a5]
push esi
push 0x40
push 3
push ebx
call edi
mov word [ebp + 0x1314a5], 0x9090
mov byte [ebp + 0x1314a7], 0x90
push esi
push dword [esp + 4]
push 3
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x65db4]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x65db4], 0xeb
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x10b330]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x1000b418], eax
mov ecx, dword [ebp + 0x10b330]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x10b334]
mov word [eax + 4], cx
mov eax, dword [0x1000b418]
lea ecx, [ebp + 0x10b336]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b418]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b418]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b418]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x10b330], 0x68
mov dword [ebp + 0x10b331], 0x100018d0
mov byte [ebp + 0x10b335], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
push str._____Effects
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x20750]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b494], eax
mov ecx, dword [ebp + 0x20750]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x20754]
mov word [eax + 4], cx
mov eax, dword [0x1000b494]
lea ecx, [ebp + 0x20756]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b494]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b494]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b494]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x20750], 0x68
mov dword [ebp + 0x20751], 0x10003500
mov byte [ebp + 0x20755], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x20930]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x20930], 0xeb
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x15c150]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b498], eax
mov ecx, dword [ebp + 0x15c150]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x15c154]
mov word [eax + 4], cx
mov eax, dword [0x1000b498]
lea ecx, [ebp + 0x15c156]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b498]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b498]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b498]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x15c150], 0x68
mov dword [ebp + 0x15c151], 0x10003540
mov byte [ebp + 0x15c155], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x1c813d]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x1c813d], 0x34
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x28691a]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x28691a], 0xd8
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov eax, dword [0x1000b370]
lea ecx, [eax + 0xe94dc]
mov dword [eax + 0x7bb330], ecx
push str._____Paint
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x2c58b0]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x2c58b0], 0xc3
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x274860]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x1000b4bc], eax
mov ecx, dword [ebp + 0x274860]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x274864]
mov word [eax + 4], cx
mov eax, dword [0x1000b4bc]
lea ecx, [ebp + 0x274866]
mov byte [eax + 6], 0x68
mov eax, dword [0x1000b4bc]
mov dword [eax + 7], ecx
mov eax, dword [0x1000b4bc]
mov byte [eax + 0xb], 0xc3
push esi
push 0x40
push 0xc
push dword [0x1000b4bc]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x274860], 0x68
mov dword [ebp + 0x274861], 0x10003620
mov byte [ebp + 0x274865], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x257650]
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x257650], 0x68
mov dword [ebp + 0x257651], 0x100038e0
mov byte [ebp + 0x257655], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x231ba0]
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x231ba0], 0x68
mov dword [ebp + 0x231ba1], 0x100038f0
mov byte [ebp + 0x231ba5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x2c9cd9]
push esi
push 0x40
push 1
push ebx
call edi
mov byte [ebp + 0x2c9cd9], 0xeb
push esi
push dword [esp + 4]
push 1
push ebx
call edi
mov ebp, dword [0x1000b370]
lea ebx, [ebp + 0x2f7a40]
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x2f7a40], 0x68
mov dword [ebp + 0x2f7a41], 0x100038f0
mov byte [ebp + 0x2f7a45], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
jmp 0x10004b83
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], 0x22c
lea edi, [esp + 0x38]
lea ebp, [esp + 0x14]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
nop word [eax + eax]
push ebp
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10004b83
push str.left4dead2.exe
push edi
call ebx
add esp, 8
test eax, eax
jne 0x10004ae0
push dword [esp + 0x1c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x100092e0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ebx, [esp + 0x240]
push 0x208
push ebx
push dword [esp + 0x464]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x208
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
add esp, 0x448
pop esi
pop edi
pop ebx
pop ebp
ret 0xc