Function at 0x30021eb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x25
push 0
push 0
dec ecx
jne 0x30021eb9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x30021ed2
add esp, 0xfffffff0
call fcn.30014a08
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
call fcn.30015938
lea eax, [ebp - 0xa4]
mov edx, dword [0x30018fe4]
call fcn.30015afc
xor eax, eax
push ebp
push 0x30022ec2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
call fcn.3001fbb4
push ebp
push 0x30022e72
push dword fs:[0]
mov dword fs:[0], esp
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x30021f45
mov edx, 0x3003fba0
mov eax, 0x3003fb9c
call fcn.3001c474
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], esi
test byte [ebp + 8], 0x20
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 0x34], al
test byte [ebp + 8], 0x40
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 0x35], al
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
lea edx, [ebp - 0xe4]
mov eax, 0x300214b8
call fcn.3001b6a4
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 0xf5a
call fcn.3001f378
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], ebx
mov byte [ebx], 0xff
mov byte [ebx + 1], 0x25
lea eax, [ebx + 6]
mov dword [ebx + 2], eax
mov edx, dword [ebp - 4]
mov eax, edi
mov dword [edx + 8], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov byte [ebp - 0x3d], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
xor ecx, ecx
mov eax, 0x30022ef8
call fcn.3001eef4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, 0x30022ef8
mov cl, 1
call fcn.3001eef4
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x30022027
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0x80000000
jb 0x3002202f
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.30015580
lea eax, [ebp - 0x20]
call fcn.300154e8
jmp 0x3002202f
lea eax, [ebp - 0x20]
call fcn.300154e8
lea edx, [ebp - 0xec]
mov eax, 0x30022f04
call fcn.30017d04
push dword [ebp - 0xec]
push 0x30022f14
push dword [ebp - 0x1c]
lea eax, [ebp - 0xe8]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0xe8]
call fcn.30015948
push eax
call fcn.3001e900
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x20], 0
je 0x300220bb
lea edx, [ebp - 0xf4]
mov eax, 0x30022f04
call fcn.30017d04
push dword [ebp - 0xf4]
push 0x30022f14
push dword [ebp - 0x20]
lea eax, [ebp - 0xf0]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0xf0]
call fcn.30015948
push eax
call fcn.3001e900
mov dword [ebp - 0x10], eax
jmp 0x300220c0
xor eax, eax
mov dword [ebp - 0x10], eax
push ebp
push 0x30022e4f
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [ebp - 0xc], 0
je 0x300220e5
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp dword [ebp - 0x10], 0
je 0x300220f6
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push ebp
push 0x30022e1c
push dword fs:[0]
mov dword fs:[0], esp
push 0xffffffffffffffff
lea edx, [ebp - 0xfc]
mov eax, 0x30022f20
call fcn.30017d04
push dword [ebp - 0xfc]
push 0x30022f14
push dword [ebp - 0x1c]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0xf8]
call fcn.30015948
push eax
call fcn.3001ec0c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
call fcn.30021c1c
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 5], 0
je 0x300221d5
cmp dword [ebp - 0x20], 0
je 0x300221d5
push 0xffffffffffffffff
lea edx, [ebp - 0x104]
mov eax, 0x30022f20
call fcn.30017d04
push dword [ebp - 0x104]
push 0x30022f14
push dword [ebp - 0x20]
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0x100]
call fcn.30015948
push eax
call fcn.3001ec0c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
call fcn.30021c1c
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 5], 0
jne 0x300221d5
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.30015580
push ebp
push 0x30022de9
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 5], 0
je 0x30022681
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0x18]
mov eax, esi
call fcn.300219f4
test al, al
je 0x3002222a
mov dword [ebp - 0x38], 0x770001
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
test byte [ebp + 8], 2
jne 0x30022292
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.300218f8
test al, al
je 0x30022247
or dword [ebp + 8], 2
jmp 0x30022292
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.3001b6a4
cmp byte [ebp - 0xa4], 0
je 0x30022267
cmp byte [ebp - 0x7c], 0
jne 0x3002226d
or dword [ebp + 8], 2
jmp 0x30022292
cmp byte [0x3003fb28], 0
jne 0x30022292
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.30021d64
test al, al
je 0x30022292
or dword [ebp + 8], 2
mov dword [ebp - 0x38], 0x770004
test byte [ebp + 8], 2
jne 0x300222d2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, esi
call fcn.30021ba0
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022691
cmp dword [ebp - 0x20], 0
je 0x30022691
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.30015580
jmp 0x30022691
test byte [ebp + 8], 0x10
jne 0x30022661
test esi, esi
je 0x3002234f
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x30022328
lea edx, [ebp - 0x10c]
mov eax, 0x30022f34
call fcn.30017d04
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
mov dl, 1
call fcn.30017d74
mov eax, dword [ebp - 0x108]
push eax
call sub.KERNEL32.dll_GetModuleHandleW
cmp esi, eax
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x36], al
jmp 0x3002234f
mov eax, 0x30022f34
lea edx, [ebp - 0x110]
call fcn.30017d04
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
cmp esi, eax
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x36], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x36], 0
je 0x30022369
test byte [ebp + 8], 0x80
je 0x30022369
mov eax, esi
call fcn.3001f404
mov ebx, eax
jmp 0x3002236b
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x36], 0
je 0x3002237c
test ebx, ebx
je 0x30022641
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x300223ac
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0x80000000
jae 0x300223b0
test esi, esi
je 0x300223ac
mov eax, esi
call fcn.30018560
mov edx, eax
mov eax, esi
call fcn.30021ba0
test al, al
jne 0x300223b0
xor eax, eax
jmp 0x300223b2
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x300223e0
cmp dword [ebp - 0x20], 0
je 0x300223d2
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.30015580
push 0
push 0xa
call fcn.3001c534
mov dword [ebp - 0x2c], eax
jmp 0x300223ed
mov eax, 0xa
call fcn.3001f378
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax], 0xff
mov eax, dword [ebp - 0x2c]
mov byte [eax + 1], 0x25
mov eax, dword [ebp - 0x2c]
add eax, 6
mov edx, dword [ebp - 0x2c]
mov dword [edx + 2], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 6], eax
mov eax, dword [0x3003ffa8]
mov dword [eax], fcn.3001f124
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, 0x30022f48
call fcn.3001eef4
push 4
lea edx, [ebp - 0x118]
mov eax, 0x30022f20
call fcn.30017d04
push dword [ebp - 0x118]
push 0x30022f14
push dword [ebp - 0x24]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0x114]
call fcn.30015948
push eax
call fcn.3001eae4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x300224bf
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x300224b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
jmp 0x300224bf
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x300225e6
push ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
mov eax, esi
call fcn.3001f554
test al, al
jne 0x300224ff
call fcn.3001f764
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 8]
jne 0x300225e6
mov eax, dword [ebp - 0x2c]
call fcn.3001f788
test al, al
je 0x300225e6
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022540
mov eax, dword [ebp - 0x14]
call fcn.3001c424
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
call fcn.3001f764
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 8]
je 0x30022540
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
call fcn.3001f7e0
test byte [ebp + 8], 4
setne al
call fcn.3001fc00
mov eax, dword [ebp - 4]
cmp byte [eax + 0x36], 0
je 0x300225a2
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x30022586
mov eax, 0x30022f34
lea edx, [ebp - 0x120]
call fcn.30017d04
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov dl, 1
call fcn.30017d74
mov eax, dword [ebp - 0x11c]
push eax
call sub.KERNEL32.dll_LoadLibraryW
jmp 0x300225a2
mov eax, 0x30022f34
lea edx, [ebp - 0x124]
call fcn.30017d04
mov eax, dword [ebp - 0x124]
push eax
call sub.KERNEL32.dll_LoadLibraryA
xor eax, eax
push ebp
push 0x300225c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
call fcn.3001f73c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x300225d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x3d], 1
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x30022691
cmp dword [ebp - 0x14], 0
je 0x300225f5
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x3002260b
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.3001c64c
jmp 0x3002261b
push 0x8000
push 0
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_VirtualFree
cmp dword [ebp - 0x38], 0
jne 0x30022628
mov dword [ebp - 0x38], 0x770002
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
mov dword [ebp - 0x38], 0x770002
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
mov dword [ebp - 0x38], 0x770002
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 5], 0x53
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x300226a0
test byte [ebp + 8], 4
jne 0x300226a4
xor eax, eax
jmp 0x300226a6
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], al
test al, al
je 0x3002287e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0x80000000
jae 0x300227d1
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
lea eax, [ebp - 0xa4]
push eax
test byte [ebp + 8], 8
setne cl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.3001c908
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x30022715
mov dword [ebp - 0x38], 0x770003
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
mov eax, dword [ebp - 0x84]
call fcn.30016034
mov esi, eax
test esi, esi
jl 0x300227b7
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x84]
lea ecx, [edx + eax*4]
cmp byte [ecx + 0x10], 0
jne 0x300227af
cmp dword [ecx + 0x18], 0
je 0x300227af
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x14]
jne 0x300227af
mov eax, dword [ecx + 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x9c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x3002279e
mov edx, 4
mov eax, dword [ebp - 0x34]
call fcn.3001c870
test al, al
je 0x300227af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
add eax, dword [ebp - 0x98]
mov edx, dword [ebp - 0x34]
mov dword [edx], eax
inc ebx
dec esi
jne 0x3002272d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
add eax, dword [ebp - 0x98]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 2], eax
jmp 0x3002287e
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.3001b6a4
cmp byte [ebp - 0xa4], 0
jne 0x3002280b
mov dword [ebp - 0x38], 0x770003
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
call fcn.30014fb8
jmp 0x30022e79
mov eax, dword [ebp - 0x84]
call fcn.30016034
mov esi, eax
test esi, esi
jl 0x3002287e
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x84]
lea edi, [edx + eax*4]
cmp byte [edi + 0x10], 0
jne 0x3002287a
cmp dword [edi + 0x18], 0
je 0x3002287a
mov eax, dword [edi + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x14]
jne 0x3002287a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x3002286f
push 0
push 4
call fcn.3001c534
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 2], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [edi + 0x18]
mov dword [edx], eax
inc ebx
dec esi
jne 0x3002281f
xor eax, eax
mov dword [ebp - 0x18], eax
xor ecx, ecx
push ebp
push 0x30022db3
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 5], 0
je 0x30022ac6
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x300228b8
push 0
push 0x22
call fcn.3001c534
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
jmp 0x300228e5
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x300228d5
push 0x22
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
jmp 0x300228e5
mov eax, 0x22
call fcn.3001f378
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x38]
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.3001a44c
cmp byte [ebp - 0x5d], 0
je 0x30022967
cmp dword [ebp - 0x50], 1
jne 0x30022926
cmp word [ebp - 0x62], 0xeb
je 0x3002291e
mov byte [esi], 0xf
mov al, byte [ebp - 0x62]
and al, 0xf
add al, 0x80
mov byte [esi + 1], al
add esi, 6
jmp 0x30022959
mov byte [esi], 0xe9
add esi, 5
jmp 0x30022959
cmp dword [ebp - 0x50], 2
jne 0x30022947
mov edi, dword [ebp - 0x44]
sub edi, ebx
mov ecx, edi
sub ecx, 3
mov edx, esi
mov eax, ebx
inc eax
call fcn.300145cc
add edi, esi
inc edi
mov esi, edi
jmp 0x30022959
mov edi, dword [ebp - 0x44]
sub edi, ebx
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.300145cc
add esi, edi
mov edx, dword [ebp - 0x5c]
mov eax, esi
sub edx, eax
sub eax, 4
mov dword [eax], edx
jmp 0x30022979
mov edi, dword [ebp - 0x44]
sub edi, ebx
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.300145cc
add esi, edi
mov ebx, dword [ebp - 0x44]
mov eax, ebx
sub eax, dword [ebp - 0x30]
cmp eax, 6
jb 0x300228ee
mov byte [esi], 0xe9
add esi, 5
sub ebx, esi
sub esi, 4
mov dword [esi], ebx
push 4
lea edx, [ebp - 0x12c]
mov eax, 0x30022f20
call fcn.30017d04
push dword [ebp - 0x12c]
push 0x30022f14
push dword [ebp - 0x1c]
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0x128]
call fcn.30015948
push eax
call fcn.3001eae4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x30022b7b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x300229f6
mov eax, dword [ebp - 0x14]
call fcn.3001c424
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x30022b7b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022a30
push 0
push 0x5c
call fcn.3001c534
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
jmp 0x30022a3f
mov eax, 0x5c
call fcn.3001f378
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], 2
mov dword [eax + 4], 8
mov edx, dword [ebp - 0x30]
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dword [eax + 0x10], ecx
mov cx, word [edx + 4]
mov word [eax + 0x14], cx
mov byte [eax + 0x16], 0xff
mov byte [eax + 0x17], 0x25
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
add edx, 0x1e
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
mov ecx, dword [eax + 0x18]
mov dword [ecx], edx
mov edx, dword [ebp - 4]
cmp byte [edx + 0xc], 0
jne 0x30022a9d
cmp byte [ebp - 0x3d], 0
jne 0x30022a9d
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
jmp 0x30022aa2
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
add edx, 0x1e
mov dword [eax + 0x20], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x28], edx
jmp 0x30022b7b
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
mov eax, dword [esi]
mov eax, dword [esi + eax*8 + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [esi + 4]
cmp eax, dword [esi]
jne 0x30022b7b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022b19
push 0
mov eax, dword [esi + 4]
add eax, eax
shl eax, 3
add eax, 0x1c
push eax
call fcn.3001c534
mov ebx, eax
jmp 0x30022b2b
mov eax, dword [esi + 4]
add eax, eax
shl eax, 3
add eax, 0x1c
call fcn.3001f378
mov ebx, eax
mov ecx, dword [esi + 4]
shl ecx, 3
add ecx, 0x1c
mov edx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.300145cc
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022b6b
push 0
mov eax, dword [ebp - 0x28]
push eax
call fcn.3001c64c
jmp 0x30022b7b
push 0x8000
push 0
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.dll_VirtualFree
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x30022cf3
test byte [ebp + 8], 1
jne 0x30022c53
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
add eax, 0xa
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
lea eax, [edx + eax*2]
mov byte [eax], 0x68
xor edx, edx
mov dword [eax + 1], edx
mov byte [eax + 5], pe_nt_image_headers32
mov word [eax + 6], 0x2583
lea edx, [eax + 1]
mov dword [eax + 8], edx
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0xc3
inc ebx
cmp ebx, 0x118
jne 0x30022ba3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
add eax, 0xf50
mov ebx, eax
mov edx, ebx
mov eax, 0x300214b8
mov ecx, dword [ebp - 0x3c]
call fcn.300145cc
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
push 0x7fffffff
mov eax, 0x30022f4c
mov ecx, 4
mov edx, ebx
call fcn.300171f0
add eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
push 0x7fffffff
mov eax, 0x30022f54
mov ecx, 4
mov edx, ebx
call fcn.300171f0
add eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
sub edx, ebx
sub edx, dword [ebp - 0x3c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x30022cf3
push 0
push 0x22
call fcn.3001c534
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, eax
mov esi, 0x3003fc44
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dl, 1
mov eax, 0x30022f64
call fcn.3001b770
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c]
inc edx
add edx, 5
sub eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c]
mov dword [edx + 2], eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x1c]
mov dword [ebx + 7], eax
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x1e]
mov dword [ebx + 0x1a], eax
lea eax, [ebx + 0x1e]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 2], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call sub.KERNEL32.dll_GetCurrentProcess
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
pop edx
call fcn.30021048
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 4]
mov ecx, dword [eax + 0x16]
mov dword [edx + 0x40], ecx
mov cx, word [eax + 0x1a]
mov word [edx + 0x44], cx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x14]
mov dword [eax + edx*8 + 0x1c], ecx
mov ecx, dword [eax + edx*8 + 0x18]
mov dword [eax + edx*8 + 0x20], ecx
mov edx, dword [ebp - 4]
cmp byte [edx + 0xc], 0
je 0x30022d52
mov edx, dword [ebp - 4]
cmp byte [edx + 0x24], 0
jne 0x30022d52
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1c]
mov dword [eax + edx*8 + 0x14], ecx
jmp 0x30022d5e
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov dword [eax + edx*8 + 0x14], ecx
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x20]
mov ecx, dword [ecx + 2]
mov dword [eax + edx*8 + 0x18], ecx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x1c]
mov edx, dword [eax + edx*8 + 0x18]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + edx*8 + 0x14]
mov edx, dword [eax + edx*8 + 0x10]
mov dword [edx], ecx
inc dword [eax]
mov eax, dword [ebp - 4]
mov byte [eax + 4], 1
mov eax, dword [ebp - 4]
call fcn.30023628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30022dba
cmp dword [ebp - 0x18], 0
je 0x30022db2
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30022ec9
lea eax, [ebp - 0x12c]
mov edx, 0x12
call fcn.3001550c
lea eax, [ebp - 0xe4]
mov edx, dword [0x30018fe4]
mov ecx, 2
call fcn.30015c0c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.3001550c
lea eax, [ebp + 0x18]
call fcn.300154e8
ret