Function at 0x10006900
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x450
mov eax, dword [esp + 0x468]
cmp eax, 1
je 0x10006922
test eax, eax
jne 0x10007f10
xor ecx, ecx
int 0x29
push str.left4dead2.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10007e43
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ebx, [eax + 0x24e0]
lea edi, [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 1
push ebx
call ebp
mov byte [esi + 0x24e0], 0xc3
push edi
push dword [esp + 0x20]
push 1
push ebx
call ebp
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Storm
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
call fcn.1001012b
add esp, 4
push eax
push 0x100239a0
push 0x100239a4
call fcn.100102b8
add esp, 0xc
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov dword [esp + 0x1c], 0x54
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
mov word [esp + 0x26], 0xc
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x190
lea eax, [esp + 0x30]
push str.Terminal
push eax
call fcn.100102de
add esp, 8
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 8
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 0xc], 0
movsx eax, word [esp + 0x248]
movsx ecx, word [esp + 0x24a]
imul ecx, eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.engine.dll
call esi
mov dword [0x1002da68], eax
push str._____Extend_Interface
call fcn.100103eb
add esp, 4
call fcn.100011a0
push str.client.dll
call esi
mov dword [0x1002df34], eax
push str._____Events
call fcn.100103eb
add esp, 4
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x17bb40]
mov dword [esp + 4], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100233a0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x17bb40]
mov dword [esi], eax
movzx eax, word [ebx + 0x17bb44]
mov word [esi + 4], ax
lea eax, [ebx + 0x17bb46]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x17bb40], 0x68
mov dword [ebx + 0x17bb41], 0x10001610
mov byte [ebx + 0x17bb45], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002df7c], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x4d590]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x4d590], 0xc3
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov edi, dword [0x1002da68]
lea esi, [edi + 0x5596f]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x5596f], 0x5e
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov edi, dword [0x1002da68]
lea esi, [edi + 0x7f60d]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x7f60d], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov eax, dword [0x1002df34]
mov dword [eax + 0x7254e8], 0x100016e0
push str._____Interpolation
call fcn.100103eb
add esp, 4
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x344f0]
mov dword [esp + 4], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100233a0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x344f0]
mov dword [esi], eax
movzx eax, word [ebx + 0x344f4]
mov word [esi + 4], ax
lea eax, [ebx + 0x344f6]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x344f0], 0x68
mov dword [ebx + 0x344f1], 0x10001720
mov byte [ebx + 0x344f5], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002df80], esi
push str._____Animations
call fcn.100103eb
add esp, 4
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x321f0]
mov dword [esp + 4], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100233b0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x321f0]
mov ecx, dword [ebx + 0x321f3]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x321f7]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call esi
mov byte [ebx + 0x321f0], 0x68
mov dword [ebx + 0x321f1], 0x10001740
mov byte [ebx + 0x321f5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x4c230]
mov dword [esp + 4], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100233a0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x4c230]
mov dword [esi], eax
movzx eax, word [ebx + 0x4c234]
mov word [esi + 4], ax
lea eax, [ebx + 0x4c236]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov eax, ebp
mov byte [ebx + 0x4c230], 0x68
mov dword [ebx + 0x4c231], 0x10002180
mov byte [ebx + 0x4c235], 0xc3
mov ebp, esp
push ebp
push dword [esp + 4]
push 6
push edi
mov ebx, eax
call eax
mov dword [0x1002e01c], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x3bdf0]
push ebp
push 0x40
push 3
push esi
call ebx
mov word [edi + 0x3bdf0], 0x18c2
mov byte [edi + 0x3bdf2], 0
push ebp
push dword [esp + 4]
push 3
push esi
call ebx
mov edi, dword [0x1002df34]
lea esi, [edi + 0x3180f6]
push ebp
push 0x40
push 1
push esi
call ebx
mov byte [edi + 0x3180f6], 0xf
push ebp
push dword [esp + 4]
push 1
push esi
call ebx
push str._____Prediction
call fcn.100103eb
add esp, 4
mov esi, dword [0x1002df34]
push ebp
push 0x40
push 0x18
push 0x1002e5d0
call ebx
movups xmm0, xmmword [esi + 0x6f3fd4]
movups xmmword [0x1002e5d0], xmm0
movsd xmm0, qword [esi + 0x6f3fe4]
movsd qword [0x1002e5e0], xmm0
push ebp
push dword [esp + 4]
push 0x18
push 0x1002e5d0
call ebx
mov dword [esi + 0x6f3fd4], 0x1002d000
mov dword [esi + 0x6f3fd8], 1
mov dword [esi + 0x6f3fe0], 0x1002e5d0
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x21fce0]
mov dword [esp + 4], eax
sub esp, 0x10
movaps xmm0, xmmword [0x100233c0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
movsd xmm0, qword [ebx + 0x21fce0]
movsd qword [eax], xmm0
lea eax, [ebx + 0x21fce8]
mov dword [esp + 8], eax
lea ebp, [esi + 8]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 8], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 9], eax
mov byte [esi + 0xd], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x21fce0], 0x68
mov dword [ebx + 0x21fce1], 0x10002450
mov byte [ebx + 0x21fce5], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov dword [0x1002e044], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x17b780]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x17b780]
mov dword [esi], eax
movzx eax, word [ebx + 0x17b784]
mov word [esi + 4], ax
lea eax, [ebx + 0x17b786]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x17b780], 0x68
mov dword [ebx + 0x17b781], 0x100024b0
mov byte [ebx + 0x17b785], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e048], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x17b860]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x17b860], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov edi, dword [0x1002df34]
lea esi, [edi + 0x17c510]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x17c510], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x17b460]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x17b460]
mov dword [esi], eax
movzx eax, word [ebx + 0x17b464]
mov word [esi + 4], ax
lea eax, [ebx + 0x17b466]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x17b460], 0x68
mov dword [ebx + 0x17b461], 0x100024f0
mov byte [ebx + 0x17b465], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e4fc], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x278870]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xe
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
movsd xmm0, qword [ebx + 0x278870]
movsd qword [eax], xmm0
lea eax, [ebx + 0x278878]
mov dword [esp + 8], eax
lea ebp, [esi + 8]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov ecx, edi
mov byte [esi + 8], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 9], eax
mov byte [esi + 0xd], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov ebp, ecx
call ecx
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x278870], 0x68
mov dword [ebx + 0x278871], 0x10002590
mov byte [ebx + 0x278875], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e500], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0xeee20]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0xeee20]
mov dword [esi], eax
movzx eax, word [ebx + 0xeee24]
mov word [esi + 4], ax
lea eax, [ebx + 0xeee26]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0xeee20], 0x68
mov dword [ebx + 0xeee21], 0x100025e0
mov byte [ebx + 0xeee25], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e504], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x17b370]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xe
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
movsd xmm0, qword [ebx + 0x17b370]
movsd qword [eax], xmm0
lea eax, [ebx + 0x17b378]
mov dword [esp + 8], eax
lea ebp, [esi + 8]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov ecx, edi
mov byte [esi + 8], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 9], eax
mov byte [esi + 0xd], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov ebp, ecx
call ecx
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x17b370], 0x68
mov dword [ebx + 0x17b371], 0x10002600
mov byte [ebx + 0x17b375], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e508], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x26cd30]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xf
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
movsd xmm0, qword [ebx + 0x26cd30]
movsd qword [eax], xmm0
movzx eax, byte [ebx + 0x26cd38]
mov byte [esi + 8], al
lea eax, [ebx + 0x26cd39]
mov dword [esp + 8], eax
lea ebp, [esi + 9]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 9], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 0xa], eax
mov byte [esi + 0xe], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x26cd30], 0x68
mov dword [ebx + 0x26cd31], 0x10002650
mov byte [ebx + 0x26cd35], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e50c], esi
mov eax, dword [0x1002df34]
sub eax, esi
add eax, 0x253597
mov dword [esi + 5], eax
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x2f34f0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x2f34f0]
mov dword [esi], eax
movzx eax, word [ebx + 0x2f34f4]
mov word [esi + 4], ax
lea eax, [ebx + 0x2f34f6]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x2f34f0], 0x68
mov dword [ebx + 0x2f34f1], 0x10002eb0
mov byte [ebx + 0x2f34f5], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e518], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x312677]
mov dword [0x1002e51c], eax
lea eax, [ebx + 0x31266e]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x31266e]
mov ecx, dword [ebx + 0x312671]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x312675]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov esi, esp
push esi
push dword [esp + 4]
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
push esi
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x31266e], 0x68
mov dword [ebx + 0x31266f], 0x10002ee0
mov byte [ebx + 0x312673], 0xc3
push esi
push dword [esp + 4]
push 6
push ebp
mov ebx, edi
call edi
push str._____Network
call fcn.100103eb
add esp, 4
mov edi, dword [0x1002da68]
lea esi, [edi + 0x1b9d3f]
mov ebp, esp
push ebp
push 0x40
push 4
push esi
call ebx
mov dword [edi + 0x1b9d3f], 0x90909090
push ebp
push dword [esp + 4]
push 4
push esi
call ebx
mov ebx, dword [0x1002da68]
lea eax, [ebx + 0x79e40]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x79e40]
mov dword [esi], eax
movzx eax, word [ebx + 0x79e44]
mov word [esi + 4], ax
lea eax, [ebx + 0x79e46]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x79e40], 0x68
mov dword [ebx + 0x79e41], 0x10002f00
mov byte [ebx + 0x79e45], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov dword [0x1002e520], esi
mov ebx, dword [0x1002da68]
lea eax, [ebx + 0x7d120]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xf
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
movsd xmm0, qword [ebx + 0x7d120]
movsd qword [eax], xmm0
movzx eax, byte [ebx + 0x7d128]
mov byte [esi + 8], al
lea eax, [ebx + 0x7d129]
mov dword [esp + 8], eax
lea ebp, [esi + 9]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 9], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 0xa], eax
mov byte [esi + 0xe], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x7d120], 0x68
mov dword [ebx + 0x7d121], 0x10002f30
mov byte [ebx + 0x7d125], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov dword [0x1002e530], esi
mov ebx, dword [0x1002da68]
lea eax, [ebx + 0x7cec0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x7cec0]
mov ecx, dword [ebx + 0x7cec3]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x7cec7]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call esi
mov ebp, esi
mov byte [ebx + 0x7cec0], 0x68
mov dword [ebx + 0x7cec1], 0x10003050
mov byte [ebx + 0x7cec5], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push edi
call esi
push str._____Input
call fcn.100103eb
add esp, 4
mov edi, dword [0x1002df34]
lea esi, [edi + 0x131545]
push ebx
push 0x40
push 3
push esi
call ebp
mov word [edi + 0x131545], 0x9090
mov byte [edi + 0x131547], 0x90
push ebx
push dword [esp + 4]
push 3
push esi
call ebp
mov edi, dword [0x1002df34]
lea esi, [edi + 0x12e03d]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x12e03d], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov edi, dword [0x1002df34]
lea esi, [edi + 0x65db4]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x65db4], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x10b3e0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x10b3e0]
mov dword [esi], eax
movzx eax, word [ebx + 0x10b3e4]
mov word [esi + 4], ax
lea eax, [ebx + 0x10b3e6]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x10b3e0], 0x68
mov dword [ebx + 0x10b3e1], 0x100032a0
mov byte [ebx + 0x10b3e5], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov dword [0x1002e540], esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0xc3ee0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0xc3ee0]
mov ecx, dword [ebx + 0xc3ee3]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0xc3ee7]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov esi, esp
push esi
push dword [esp + 4]
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
push esi
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0xc3ee0], 0x68
mov dword [ebx + 0xc3ee1], 0x10004c90
mov byte [ebx + 0xc3ee5], 0xc3
push esi
push dword [esp + 4]
push 6
push ebp
call edi
push str._____Effects
call fcn.100103eb
add esp, 4
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x20750]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x20750]
mov dword [esi], eax
movzx eax, word [ebx + 0x20754]
mov word [esi + 4], ax
lea eax, [ebx + 0x20756]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call edi
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call edi
mov byte [ebx + 0x20750], 0x68
mov dword [ebx + 0x20751], 0x10004f60
mov byte [ebx + 0x20755], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push ebp
mov ebp, edi
call edi
mov dword [0x1002e56c], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x20930]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x20930], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov edi, dword [0x1002df34]
lea esi, [edi + 0x2bf81e]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x2bf81e], 0xf6
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x15c1e0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x15c1e0]
mov dword [esi], eax
movzx eax, word [ebx + 0x15c1e4]
mov word [esi + 4], ax
lea eax, [ebx + 0x15c1e6]
mov dword [esp + 8], eax
lea ebp, [esi + 6]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 7], eax
mov byte [esi + 0xb], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov eax, ebp
mov byte [ebx + 0x15c1e0], 0x68
mov dword [ebx + 0x15c1e1], 0x10004fa0
mov byte [ebx + 0x15c1e5], 0xc3
mov ebp, esp
push ebp
push dword [esp + 4]
push 6
push edi
mov ebx, eax
call eax
mov dword [0x1002e570], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x1c81cd]
push ebp
push 0x40
push 1
push esi
call ebx
mov byte [edi + 0x1c81cd], 0x34
push ebp
push dword [esp + 4]
push 1
push esi
call ebx
mov edi, dword [0x1002df34]
lea esi, [edi + 0x28853a]
push ebp
push 0x40
push 1
push esi
call ebx
mov byte [edi + 0x28853a], 0xd8
push ebp
push dword [esp + 4]
push 1
push esi
call ebx
mov eax, dword [0x1002df34]
lea ecx, [eax + 0xe953c]
mov dword [eax + 0x7bd3b0], ecx
push str._____Paint
call fcn.100103eb
add esp, 4
push str.vguimatsurface.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
add eax, 0x188f0
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov eax, dword [esi + 0x188f0]
mov dword [edi], eax
movzx eax, word [esi + 0x188f4]
mov word [edi + 4], ax
lea eax, [esi + 0x188f6]
mov dword [esp + 8], eax
lea ebp, [edi + 6]
mov eax, esp
push eax
push 0x40
push 6
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
mov byte [edi + 6], 0x68
mov eax, dword [esp + 8]
mov dword [edi + 7], eax
mov byte [edi + 0xb], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call ebx
mov eax, esp
push eax
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call ebx
mov byte [esi + 0x188f0], 0x68
mov dword [esi + 0x188f1], 0x100050d0
mov byte [esi + 0x188f5], 0xc3
mov eax, esp
push eax
push dword [esp + 4]
push 6
push ebp
call ebx
mov dword [0x1002e574], edi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x2c74e0]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x2c74e0]
mov ecx, dword [ebx + 0x2c74e3]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x2c74e7]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call esi
mov byte [ebx + 0x2c74e0], 0x68
mov dword [ebx + 0x2c74e1], 0x100051c0
mov byte [ebx + 0x2c74e5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call esi
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x257830]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x257830]
mov ecx, dword [ebx + 0x257833]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea eax, [ebx + 0x257837]
mov dword [esp + 8], eax
lea ebp, [esi + 7]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push ebp
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
mov byte [esi + 7], 0x68
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xc], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call ebp
mov byte [ebx + 0x257830], 0x68
mov dword [ebx + 0x257831], 0x100065f0
mov byte [ebx + 0x257835], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push edi
call ebp
mov dword [0x1002e5c8], esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x3182ab]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x3182ab], 0x31
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x231d00]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x231d00]
mov ecx, dword [ebx + 0x231d03]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x231d07]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
mov edi, dword [esp + 0x10]
push edi
call esi
mov ebp, esi
mov byte [ebx + 0x231d00], 0x68
mov dword [ebx + 0x231d01], 0x10006620
mov byte [ebx + 0x231d05], 0xc3
mov ebx, esp
push ebx
push dword [esp + 4]
push 6
push edi
call esi
mov edi, dword [0x1002df34]
lea esi, [edi + 0x2cb929]
push ebx
push 0x40
push 1
push esi
call ebp
mov byte [edi + 0x2cb929], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call ebp
mov ebx, dword [0x1002df34]
lea eax, [ebx + 0x2f9680]
mov dword [esp + 4], eax
push 0x40
push 0x3000
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [ebx + 0x2f9680]
mov ecx, dword [ebx + 0x2f9683]
mov dword [esi], eax
mov dword [esi + 3], ecx
lea edi, [ebx + 0x2f9687]
lea ebp, [esi + 7]
mov eax, esp
push eax
push 0x40
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [esi + 7], 0x68
mov dword [esi + 8], edi
mov byte [esi + 0xc], 0xc3
mov edi, esp
push edi
push dword [esp + 4]
push 6
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push edi
push 0x40
push 6
mov ebp, dword [esp + 0x10]
push ebp
call esi
mov byte [ebx + 0x2f9680], 0x68
mov dword [ebx + 0x2f9681], 0x10006620
mov byte [ebx + 0x2f9685], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call esi
jmp 0x10007f10
mov ebx, dword [esp + 0x464]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x1c], 0x22c
lea edi, [esp + 0x40]
lea ebp, [esp + 0x1c]
nop word cs:[eax + eax]
push ebp
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10007f10
push str.left4dead2.exe
push edi
call fcn.10010472
add esp, 8
test eax, eax
jne 0x10007e70
push dword [esp + 0x24]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x100233d0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ebp, [esp + 0x248]
push 0x208
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x208
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
add esp, 0x450
pop esi
pop edi
pop ebx
pop ebp
ret 0xc