Function at 0x10027b82
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1013563b
call fcn.1007db34
sub esp, 0x570
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x2c]
xor edi, edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x6c], edi
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x6c]
push ecx
push eax
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
mov dword [ebp - 4], edi
call fcn.1002f4c9
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.10094cc0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x38], edi
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
mov byte [ebp - 4], 3
call fcn.1002f696
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.10094cc0
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
call fcn.1008f010
cmp dword [ebp + 0x10], edi
mov byte [ebp - 4], 6
mov ebx, 0x101ad1f8
jne 0x10027c6f
push edi
mov ecx, ebx
call fcn.1004bccb
test eax, eax
je 0x10027c6f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
call fcn.100943c0
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 7
call fcn.1002f8a9
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.10094cc0
cmp dword [ebp - 0x30], edi
je 0x10027c63
push dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
call fcn.1008fc80
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10094cc0
push 4
lea ecx, [ebp - 0x7c]
call fcn.1005eb25
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0xa
cmp eax, edi
mov esi, 0x101ad158
je 0x10027cb0
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnCreateProcessAsUserA___App:_S___Cmd:_S_____S_
push 0x101786b8
push 4
call fcn.1007bb15
add esp, 0x1c
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 6
call fcn.1005eb48
mov ecx, esi
call fcn.10057e76
test eax, eax
je 0x10027d26
mov ecx, esi
call fcn.10057c87
test eax, eax
je 0x10027d26
push str.._
push 0x101786a8
lea ecx, [ebp - 0x10]
call fcn.10091770
test eax, eax
je 0x10027cef
mov dword [ebp - 0x30], 1
mov esi, 0x10160a78
push 0x10160a84
push esi
lea ecx, [ebp - 0x4c]
call fcn.10096c00
test eax, eax
je 0x10027d0d
mov dword [ebp - 0x6c], 1
push 0x10160a84
push esi
lea ecx, [ebp - 0x34]
call fcn.10096c00
test eax, eax
je 0x10027d26
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], edi
push eax
call fcn.100011ce
test eax, eax
pop ecx
je 0x10027ee2
test byte [ebp - 0x68], 1
je 0x10027ee2
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
mov dword [ebp + 8], edi
mov dword [ebp - 0x3c], edi
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x2c], eax
je 0x10027e27
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x30], edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x10027da2
mov eax, dword [ebp + 0x14]
jmp 0x10027db0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], edi
mov dword [ebp + 0x14], eax
jne 0x10027dbd
mov eax, dword [ebp + 0x10]
jmp 0x10027dd5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
call fcn.1008f1e0
mov dword [ebp - 0x14], 1
mov eax, dword [eax]
mov byte [ebp - 4], 0xb
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push esi
call dword [ebp - 0x2c]
test byte [ebp - 0x14], 1
mov dword [ebp - 4], 6
je 0x10027e0d
lea ecx, [ebp - 0x48]
call fcn.1008f940
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xc], eax
jmp 0x10027ecb
mov ebx, dword [esi + 0x18]
cmp ebx, edi
je 0x10027ecb
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x30], edi
jne 0x10027e45
mov eax, dword [ebp + 0x14]
jmp 0x10027e53
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], edi
mov dword [ebp + 0x14], eax
jne 0x10027e60
mov eax, dword [ebp + 0x10]
jmp 0x10027e78
push dword [ebp - 0x34]
lea ecx, [ebp - 0x20]
call fcn.1008f1e0
mov dword [ebp - 0x14], 2
mov eax, dword [eax]
mov byte [ebp - 4], 0xc
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
call ebx
test byte [ebp - 0x14], 2
mov ebx, eax
mov dword [ebp - 4], 6
je 0x10027eb0
lea ecx, [ebp - 0x20]
call fcn.1008f940
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10027ecb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x30], edi
je 0x10027eda
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100906a0
mov esi, dword [esi + 0x14]
jmp 0x100289b2
and byte [ebp - 0x194], 0
and dword [ebp - 0x24], 0
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
push 4
lea ecx, [ebp - 0x64]
call fcn.1005eb25
push dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.100943c0
push dword [ebp + 0x10]
mov esi, dword [eax]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
call fcn.100943c0
mov eax, dword [eax]
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.1004ee2f
test eax, eax
jne 0x10027f40
call fcn.100511e1
test eax, eax
jne 0x10027f66
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x10027f60
mov ecx, ebx
call fcn.1004dc65
neg eax
sbb al, al
inc al
mov byte [ebp - 0x19], al
jne 0x10027f66
and byte [ebp - 0x19], 0
jmp 0x10027f6a
mov byte [ebp - 0x19], 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
call fcn.10094cc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.10094cc0
cmp byte [ebp - 0x19], 0
je 0x10027fda
lea eax, [ebp - 0x194]
push 0x104
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1002b9e7
add esp, 0x10
test eax, eax
je 0x10027fd3
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x20]
push eax
call fcn.100943c0
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x10
call fcn.1004f0fe
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xd
call fcn.10094cc0
jmp 0x10027fda
mov dword [ebp - 0x24], 2
push dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.100943c0
mov esi, dword [eax]
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.100943c0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
push esi
push eax
mov byte [ebp - 4], 0x12
call fcn.1002fa4b
lea ecx, [ebp - 0x20]
mov esi, eax
mov byte [ebp - 4], 0x11
call fcn.10094cc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.10094cc0
xor ebx, ebx
mov byte [ebp - 4], 6
cmp esi, ebx
lea ecx, [ebp - 0x64]
je 0x10028061
call fcn.1005eb48
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.1008f940
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10094cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10094cc0
xor eax, eax
jmp 0x100289d8
call fcn.1005eb48
cmp dword [ebp - 0x24], ebx
jne 0x10028224
push 1
lea ecx, [ebp - 0x18]
call fcn.10001261
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 0x13
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
mov edi, dword [esi + 0x20]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
test eax, eax
mov dword [ebp - 0x20], eax
je 0x1002815d
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x30], 0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x100280da
mov eax, dword [ebp + 0x14]
jmp 0x100280e8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push dword [eax - 8]
call fcn.100905d0
cmp dword [ebp - 0x38], 0
mov dword [ebp + 0x14], eax
jne 0x100280f6
mov eax, dword [ebp + 0x10]
jmp 0x1002810e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.1008f1e0
mov dword [ebp - 0x14], 4
mov eax, dword [eax]
mov byte [ebp - 4], 0x14
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push esi
call dword [ebp - 0x20]
test byte [ebp - 0x14], 4
mov dword [ebp - 4], 0x13
je 0x10028146
lea ecx, [ebp - 0x2c]
call fcn.1008f940
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x20], edi
mov dword [esi + 0xc], eax
jmp 0x10028200
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10028200
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x30], 0
jne 0x1002817c
mov ebx, dword [ebp + 0x14]
jmp 0x1002818c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push dword [eax - 8]
call fcn.100905d0
mov ebx, eax
cmp dword [ebp - 0x38], 0
jne 0x10028197
mov eax, dword [ebp + 0x10]
jmp 0x100281af
push dword [ebp - 0x34]
lea ecx, [ebp + 0x14]
call fcn.1008f1e0
mov dword [ebp - 0x14], 8
mov eax, dword [eax]
mov byte [ebp - 4], 0x15
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push eax
push dword [ebp + 0xc]
call edi
test byte [ebp - 0x14], 8
mov ebx, eax
mov dword [ebp - 4], 0x13
je 0x100281e5
lea ecx, [ebp + 0x14]
call fcn.1008f940
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10028200
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x30], 0
je 0x10028210
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100906a0
mov esi, dword [esi + 0x14]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.1000127e
jmp 0x100289b2
push 0x101aad04
lea ecx, [ebp - 0x18]
call fcn.1008f010
push 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x16
call fcn.1005eb25
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x17
push dword [ebp + 0x10]
push eax
call fcn.1002c7bb
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
call fcn.1008fac0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call fcn.1008f940
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], ebx
je 0x10028284
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x18]
call fcn.1008fac0
jmp 0x10028299
cmp dword [ebp - 0x30], ebx
je 0x1002828e
lea eax, [ebp - 0x10]
jmp 0x10028279
push dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
call fcn.1008fba0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x16
call fcn.1005eb48
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.100943c0
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x14]
push eax
mov byte [ebp - 4], 0x19
call fcn.100943c0
push dword [ebp - 0x28]
mov eax, dword [eax]
mov esi, 0x101aa510
mov byte [ebp - 4], 0x1a
push eax
mov ecx, esi
call fcn.1000a658
lea ecx, [ebp + 0x14]
mov edi, eax
mov byte [ebp - 4], 0x19
call fcn.10094cc0
cmp edi, ebx
je 0x10028315
lea eax, [ebp + 0x14]
mov ecx, esi
push eax
mov dword [ebp + 0x14], ebx
push dword [ebp - 0x28]
call fcn.1000a694
cmp dword [ebp + 0x14], ebx
je 0x10028315
push dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
call fcn.1008fc80
push dword [ebp + 0x14]
call fcn.1007de95
pop ecx
push 1
lea ecx, [ebp - 0x78]
call fcn.10001261
and dword [ebp - 0x5c], 0
xor eax, eax
lea edi, [ebp - 0x58]
mov esi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x74], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp + 0x24]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 8]
push eax
push edi
or ebx, 4
call fcn.1005e85a
mov eax, dword [ebp + 0x14]
add esp, 0x10
test eax, eax
mov dword [ebp - 0x20], eax
je 0x1002841a
mov ecx, dword [esi + 0xc]
cmp dword [ebp - 0x38], 0
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
jne 0x10028395
mov eax, dword [ebp + 0x10]
jmp 0x100283b0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x84]
call fcn.1008f1e0
mov dword [ebp - 0x14], 0x10
mov eax, dword [eax]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
push ecx
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x30]
lea ecx, [ebp - 0x18]
mov eax, dword [eax - 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.100905d0
push eax
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
push esi
call dword [ebp - 0x20]
test byte [ebp - 0x14], 0x10
mov dword [ebp - 4], 0x1b
je 0x10028400
and dword [ebp - 0x14], 0xffffffef
lea ecx, [ebp - 0x84]
call fcn.1008f940
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x60]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0xc], eax
jmp 0x100284b8
mov eax, dword [esi + 0x18]
test eax, eax
mov dword [ebp - 0x40], eax
je 0x100284b8
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x38], 0
jne 0x1002843c
mov edi, dword [ebp + 0x10]
jmp 0x10028454
push dword [ebp - 0x34]
lea ecx, [ebp - 0x60]
call fcn.1008f1e0
mov dword [ebp - 0x14], 0x20
mov edi, dword [eax]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x18]
push dword [ebp + 0x30]
mov eax, dword [eax - 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.100905d0
push eax
push edi
push dword [ebp + 0xc]
call dword [ebp - 0x40]
test byte [ebp - 0x14], 0x20
mov edi, eax
mov dword [ebp - 4], 0x1b
je 0x1002849d
and dword [ebp - 0x14], 0xffffffdf
lea ecx, [ebp - 0x60]
call fcn.1008f940
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x100284b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [ebp - 0x30], 0
je 0x100284c8
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100906a0
mov eax, dword [esi + 0x14]
push 4
lea ecx, [ebp - 0x8c]
mov dword [ebp + 0x30], eax
call fcn.1005eb25
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0x1e
test eax, eax
je 0x10028566
cmp dword [ebp - 0x38], 0
jne 0x10028505
push dword [ebp + 0x10]
lea ecx, [ebp + 0x28]
call fcn.100943c0
or dword [ebp - 0x14], 0x40
mov edi, dword [eax]
mov byte [ebp - 4], 0x1f
jmp 0x10028508
mov edi, dword [ebp - 0x34]
push dword [ebp - 0x18]
lea ecx, [ebp + 0x14]
call fcn.100943c0
mov ebx, eax
mov dword [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebx]
push edi
push 0x4ce
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d_appname__s__NewCmdLine__s__CurrentDirectory__s__Ret__d__error__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x24
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x1f
call fcn.10094cc0
test byte [ebp - 0x14], 0x40
mov dword [ebp - 4], 0x1e
je 0x10028566
lea ecx, [ebp + 0x28]
call fcn.10094cc0
cmp dword [ebp + 0x30], 0
je 0x1002897c
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x28]
push eax
call fcn.100943c0
push dword [eax]
mov edi, 0x101ad1f8
mov ecx, edi
mov byte [ebp - 4], 0x21
call fcn.10050190
test eax, eax
jne 0x100285e1
mov ecx, edi
call fcn.1004ed3e
test eax, eax
jne 0x100285dd
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x100285e1
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x14]
push eax
call fcn.100943c0
mov eax, dword [eax]
push str.ReaderHostU.exe
push eax
call fcn.1007edba
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp + 0x14]
setne bl
call fcn.10094cc0
test bl, bl
je 0x100285e1
mov bl, 1
jmp 0x100285e3
xor bl, bl
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
test bl, bl
je 0x10028629
push dword [ebp - 0x4c]
push 1
push dword [ebp - 0x54]
call fcn.10052dd3
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.1007c2fd
lea eax, [ebp - 0x54]
push 1
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x22
call fcn.1007d10b
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.1007c326
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x14]
push eax
call fcn.100943c0
push dword [ebp - 0x54]
mov eax, dword [eax]
mov ecx, edi
mov byte [ebp - 4], 0x23
push eax
call fcn.1004cf1a
lea ecx, [ebp + 0x14]
mov esi, eax
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
test esi, esi
je 0x100286c7
lea ecx, [ebp - 0x44]
call fcn.1007c2fd
lea eax, [ebp - 0x54]
push 1
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x24
call fcn.1007d10b
cmp dword [0x101b04b8], 0
je 0x100286bb
lea eax, [ebp - 0x194]
lea ecx, [ebp + 0x14]
push eax
call fcn.100943c0
push dword [ebp - 0x54]
mov byte [ebp - 4], 0x25
push dword [eax]
push 0x4e0
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d_FileDevice_Allow_it...Proc__s__PID__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x18
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x24
call fcn.10094cc0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1e
call fcn.1007c326
lea eax, [ebp + 0x2c]
and dword [ebp + 0x2c], 0
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x5c]
call fcn.10027369
add esp, 0xc
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x100286ea
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 0x14], eax
push dword [ebp + 0x14]
mov esi, 0x101aad04
call fcn.100ab010
test eax, eax
pop ecx
je 0x10028708
cmp dword [ebp - 0x24], 4
je 0x1002870e
and dword [ebp - 0x24], 0
jmp 0x1002870e
mov esi, dword [0x101ad644]
push esi
lea ecx, [ebp + 0x28]
call fcn.100943c0
mov eax, dword [eax]
push 0
push eax
mov byte [ebp - 4], 0x26
call fcn.1007344b
mov ebx, eax
pop ecx
neg ebx
pop ecx
mov byte [ebp - 4], 0x1e
sbb bl, bl
lea ecx, [ebp + 0x28]
inc bl
call fcn.10094cc0
test bl, bl
je 0x10028743
and dword [ebp - 0x24], 0
xor ebx, ebx
xor edi, edi
call fcn.100bc6f0
test eax, eax
je 0x1002875b
push str.tsysdrv.dll
call fcn.100d6050
pop ecx
mov eax, dword [ebp - 0x24]
cmp eax, 1
jne 0x10028771
push esi
push dword [ebp - 0x58]
push dword [ebp + 0x14]
call fcn.100d7160
jmp 0x1002879f
cmp eax, 2
je 0x1002878c
cmp eax, 4
jne 0x1002878f
push esi
push dword [ebp - 0x54]
call fcn.10059a8e
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x100287a4
push ebx
jmp 0x10028796
cmp eax, 3
jne 0x100287a4
push 1
push esi
push dword [ebp + 0x14]
call fcn.100d7370
add esp, 0xc
mov edi, eax
cmp dword [0x101b04b8], ebx
je 0x100287d6
lea eax, [ebp - 0x194]
mov ecx, 0x101ad158
push eax
push edi
push dword [ebp - 0x24]
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnCreateProcessAsUserA___Type:_d__Inject__d____s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x1c
mov ecx, 0x101ad158
call fcn.10057df6
test eax, eax
je 0x10028947
cmp dword [ebp + 0x10], 0
je 0x10028947
push dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
call fcn.100943c0
push dword [eax]
mov byte [ebp - 4], 0x27
call fcn.10057a13
pop ecx
cmp eax, 0x310
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x1e
sete bl
call fcn.10094cc0
test bl, bl
je 0x10028947
mov ecx, 0x101ad158
call fcn.100aa440
push eax
lea ecx, [ebp + 0x10]
call fcn.10094520
mov eax, dword [0x101b04b8]
mov byte [ebp - 4], 0x28
test eax, eax
mov ebx, str.SafeDoc
je 0x10028862
push dword [ebp + 0x10]
push 0x53b
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
mov edx, dword [ebp + 0x10]
cmp dword [edx - 8], 0
je 0x1002893b
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], esi
stosd dword es:[edi], eax
mov ecx, 0xf9
lea edi, [ebp - 0x57a]
mov word [ebp - 0x57c], si
push 0x1f3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x57c]
push edx
push eax
call fcn.1007e246
lea eax, [ebp - 0x44]
push 2
push eax
lea eax, [ebp - 0x57c]
push eax
call fcn.100271ef
add esp, 0x18
cmp eax, 2
jne 0x1002891d
cmp dword [0x101b04b8], esi
je 0x100288df
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x54d
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d__Cmd1__s___Cmd2__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x18
push dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
call fcn.1002c5b0
mov edi, eax
push edi
push dword [ebp - 0x54]
call fcn.1000a24d
cmp dword [0x101b04b8], esi
pop ecx
pop ecx
je 0x1002893b
push dword [ebp + 0x10]
push dword [ebp - 0x54]
push edi
push 0x554
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d__Enable__d__PID__d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x1002893b
cmp dword [0x101b04b8], esi
je 0x1002893b
push eax
push 0x548
push str._CSafeInject::OnCreateProcessAsUserA__Line:_d__iCount__d_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x1e
call fcn.10094cc0
cmp dword [ebp + 0x2c], 0
je 0x10028956
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 0x24], 4
jne 0x10028965
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp + 0x34], 0
je 0x1002897c
lea eax, [ebp - 0x5c]
push 0x10
push eax
push dword [ebp + 0x34]
call fcn.1007dea0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x1b
call fcn.1005eb48
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x19
call fcn.1000127e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
call fcn.10094cc0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.1008f940
mov esi, dword [ebp + 0x30]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.1008f940
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10094cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10094cc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x30