Function at 0x10023130
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101db670], eax
mov byte [ebp - 0x64], 0xf0
lea edi, [eax + 0x159]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xd0
add edi, 0x189
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0xac], 0x339
add edi, 0x190
mov byte [ebp - 0xaa], 0x34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea eax, [ebp - 0xac]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0x80], 0xd684
add edi, 0x1c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0x2e3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xe0
add edi, 0x2b9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0xa8], 0x3d71
add edi, 0x811e4
mov byte [ebp - 0xa6], 0x8a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xa8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x2c], 0x48637440
add edi, 0x1acf6a
mov dword [ebp - 0x28], 0xe4548d51
mov dword [ebp - 0x24], 0xe9835220
mov byte [ebp - 0x20], 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push 0x40
push 0xd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0xd
lea eax, [ebp - 0x2c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 1
add edi, 0x27adca
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0xeb
add edi, 0x103250
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0xea60
add edi, 0x5f1e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0
add edi, 0xc7903
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0xeb
add edi, 0xdbb12
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xeb
add edi, 0xdbb58
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0xeb
add edi, 0xdbb9e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xeb
add edi, 0xdbbe4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0x7e
add edi, 0x691d1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0x7e
add edi, 0x6a440
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0xa0], 0x851f
add edi, 0xb7d25
mov byte [ebp - 0x9e], 0x6b
mov word [ebp - 0x84], 0x6eb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea eax, [ebp - 0xa0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0xb8de9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x84]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0x88], 0x22eb
add edi, 0x7b020
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x88]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x1c], 0xc8fe0474
add edi, 0xd094b
mov word [ebp - 0x18], 0xc475
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x3e4ccccd
add edi, 0xdfc09
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x7c], 0
add edi, 0xdad6d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0xdadb4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0xdae0b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0xdae87
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0
add edi, 0x1d8690
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0
add edi, 0x1d86e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x2710
add edi, 0xd2c02
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x186a0
add edi, 0xd2c32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x98967f
add edi, 0xd2c94
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov byte [ebp - 0x60], 0
mov edi, dword [0x101db670]
add edi, 0xd3180
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x2710
add edi, 0xeef90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0
add edi, 0xf045b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x41a00000
add edi, 0xf86a3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0
add edi, 0x1186e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0xeb
add edi, 0x11db44
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xeb
add edi, 0x111c3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0xeb
add edi, 0x111c80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0
add edi, 0x11c8fb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 0
add edi, 0x11c9bb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x14], 0x90909090
add edi, 0x12d052
mov word [ebp - 0x10], 0x9090
mov word [ebp - 0x8c], 0x6deb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x14]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0x53
add edi, 0x12d0f6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x64], 2
add edi, 0x12d0f9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xca
add edi, 0x12d100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
add edi, 0x12d132
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x8c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
movaps xmm0, xmmword [0x1008ba90]
mov edi, dword [0x101db670]
movups xmmword [ebp - 0x5c], xmm0
add edi, 0x14a65b
mov dword [ebp - 0x3c], 0xb025eb
movaps xmm0, xmmword [0x1008ba80]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], 0xf98186
mov dword [ebp - 0x34], 0xcaa20000
mov word [ebp - 0x30], 0x67ec
mov byte [ebp - 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x2f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x2f
lea eax, [ebp - 0x5c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov byte [ebp - 0x60], 0xeb
add edi, 0x166c2b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x60]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0x90], 0x2750
add edi, 0x1c7329
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x90]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x3f000000
add edi, 0x210530
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x4a371b00
add edi, 0x210534
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x4a371b00
add edi, 0x1c8910
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x3fb9999a
add edi, 0x1c9804
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x4e6e6b28
add edi, 0x1caee8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x5368d4a5
add edi, 0x1d15b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x3f70a3d7
add edi, 0x1d6d38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x4cbebc20
add edi, 0x1d848c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov word [ebp - 0x94], 0xe990
add edi, 0xd5936
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x94]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x447a0000
add edi, 0x212af0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0xbf800000
add edi, 0x212af8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x459c4000
add edi, 0x212b00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x47c35000
add edi, 0x212b04
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x437a0000
add edi, 0x212c58
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0xbf800000
add edi, 0x212c60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x44fa0000
add edi, 0x212c68
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x47435000
add edi, 0x212c6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x47435000
add edi, 0x213158
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x459c4000
add edi, 0x213168
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x47435000
add edi, 0x21316c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x42b40000
add edi, 0x212de8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0xbf800000
add edi, 0x212df0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x70], 0x44fa0000
add edi, 0x212df8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov edi, dword [0x101db670]
mov dword [ebp - 0x68], 0x46c35000
add edi, 0x212dfc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.common.dll
call eax
mov ebx, eax
mov dword [ebp - 0x68], 0x42200000
lea edi, [ebx + 0x18bdb8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x68], 0x3f800000
lea edi, [ebx + 0x6de13]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x68], 0x3f800000
lea edi, [ebx + 0x50527]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x68], 0x40400000
lea edi, [ebx + 0x13e6d0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x101db710
push 0x40
push 4
push 0x4cfe8f
call esi
push 0x101db710
push 0x40
push 4
push 0x4d0936
call esi
push 0x101db710
push 0x40
push 4
push 0x5a811b
call esi
mov eax, dword [0x4cfe8f]
mov edi, dword [0x101db670]
mov dword [0x101db714], eax
add edi, 0x1c6644
add eax, 0x4cfe93
mov dword [0x101db708], eax
mov eax, 0x1002c650
sub eax, 0x4cfe93
mov dword [0x101db70c], eax
mov eax, dword [0x5a811b]
mov eax, dword [eax]
mov dword [0x101db704], eax
mov dword [0x5a811b], 0x1009414c
mov dword [ebp - 0xb4], 0x10025d30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xb4]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x101db670]
mov dword [ebp - 0xb8], 0x10025f70
add edi, 0x1c6b34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db68c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xb8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x101db670]
mov dword [ebp - 0xbc], 0x10025e10
add edi, 0x1c65cc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db6c0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xbc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str._RefireDelayElapsed_CELauncher__MBE_NXZ
push str.common.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 6
mov edx, 0x10016080
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db664], eax
push str._init_CProjectile__UAEXABUCreateParms_1__Z
push str.common.dll
call edi
push eax
call esi
push 5
mov edx, 0x1001a280
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db4f8], eax
push str._set_dead_CProjectile__UAEXXZ
push str.common.dll
call edi
push eax
call esi
push 0xa
mov edx, 0x1001a460
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db520], eax
push str.__1CGuided__UAE_XZ
push str.common.dll
call edi
push eax
call esi
push 7
mov edx, 0x1001a1a0
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db61c], eax
push str.__1CShip__UAE_XZ
push str.common.dll
call edi
push eax
call esi
push 7
mov edx, 0x10017f40
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db524], eax
push str._Update_CEPower__UAE_NMI_Z
push str.common.dll
call edi
push eax
call esi
push 6
mov edx, 0x10016e20
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db540], eax
mov word [ebp - 0x98], 0x9090
lea edi, [ebx + 0x325e8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x98]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb0], 0x3ff00000
lea edi, [ebx + 0x327a6]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xb0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [0x1008bb60]
lea edi, [ebx + 0x13c138]
movups xmmword [ebx + 0x18b390], xmm0
mov dword [ebp - 0xc0], 0x10025c00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db694
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xc0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc4], 0x10025d20
lea edi, [ebx + 0x13c064]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db6a8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xc4]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x101db670]
mov dword [ebp - 0xc8], 0x10028240
add edi, 0x1e6668
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db6c4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xc8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 0x13e678]
mov dword [ebp - 0xcc], 0x46ea6000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call ebx
push 0
push 4
lea eax, [ebp - 0xcc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x101db670]
add edi, 0x1dbb80
mov dword [ebp - 0xd0], 0x10025fa0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push 0x101db67c
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xd0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov dword [ebp - 0xd4], 0x10025fb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5dbd30
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db678
push 0x5dbd30
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5dbd30
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xd4]
push eax
push 0x5dbd30
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
mov dword [ebp - 0xd8], 0x10025fc0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5db9b0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db680
push 0x5db9b0
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5db9b0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xd8]
push eax
push 0x5db9b0
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
mov ebx, dword [0x101db670]
add ebx, 0x137860
mov dword [ebp - 0xec], 0x10026080
mov dword [0x101db690], ebx
mov byte [ebp - 0x72], 0xb8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x72]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
lea edi, [ebx + 1]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xec]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [ebp - 0x9c], 0xe0ff
lea edi, [ebx + 5]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [0x101db5b0], 0x612fb4
mov dword [0x101db5bc], 0x612b7c
mov dword [0x101db5c8], 0x612ba4
mov dword [0x101db5d4], 0x612b2c
mov dword [0x101db5e0], 0x612ab4
mov dword [0x101db5ec], 0x612adc
mov dword [0x101db5f8], 0x612b04
call eax
mov dword [ebp - 0xdc], 0x10026130
mov byte [ebp - 0x71], 0xba
mov word [ebp - 0x78], 0xd2ff
lea ebx, [eax + 0x37de0]
mov word [ebp - 0xa4], 0x8c2
mov byte [ebp - 0xa2], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x71]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
lea edi, [ebx + 1]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xdc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 5]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x78]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 7]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call ebx
add eax, 0x37deb
push 0
mov dword [0x101db6ac], eax
call ebx
mov dword [ebp - 0xe0], 0x10026150
mov byte [ebp - 0x73], 0xc3
lea ebx, [eax + 0x176410]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x71]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
lea edi, [ebx + 1]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xe0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 5]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x78]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 7]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x73]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
lea eax, [ebx + 8]
mov dword [ebp - 0xe4], 0x10026180
mov dword [0x101db688], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5e1aa8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push 0x101db698
push 0x5e1aa8
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5e1aa8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xe4]
push eax
push 0x5e1aa8
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
mov dword [ebp - 0xe8], 0x100261a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5e1a70
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db6b8
push 0x5e1a70
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 4
push 0x5e1a70
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xe8]
push 0
push 4
push eax
push 0x5e1a70
push esi
call ebx
push esi
call edi
mov byte [ebp - 0xc], 0xb9
mov word [ebp - 7], 0xe1ff
mov dword [ebp - 0xb], 0x10029d40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 7
push 0x57da40
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 7
lea eax, [ebp - 0xc]
push eax
push 0x57da40
push esi
call ebx
push esi
call edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x70]
mov edi, esi
push eax
push 4
push 0xf
push 0x4347e0
call ebx
mov ecx, 0x4347e0
movq xmm0, qword [ecx]
movq qword [esi], xmm0
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov ax, word [ecx + 0xc]
mov word [esi + 0xc], ax
mov al, byte [ecx + 0xe]
mov byte [esi + 0xe], al
add esi, 0xf
mov eax, 0x4347ea
sub eax, esi
mov dword [esi + 1], eax
mov eax, 0x10029d70
mov byte [esi], 0xe9
sub eax, 0x4347e5
mov dword [0x4347e1], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
mov byte [0x4347e0], 0xe9
push 0xf
push ecx
call ebx
mov dword [0x101db6cc], edi
call fcn.10022f40
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str._get_value_int_INI_Reader__QAEHI_Z
push str.common.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0xc
mov edx, 0x10029280
mov ecx, eax
call fcn.1002b8b0
add esp, 4
mov dword [0x101db6c8], eax
push str._open_INI_Reader__QAE_NPBD_N_Z
push str.common.dll
call ebx
push eax
call esi
push 7
mov edx, 0x10021760
mov ecx, eax
call fcn.1002b8b0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov dword [0x101db668], eax
pop edi
pop esi
pop ebx
call fcn.1004d763
mov esp, ebp
pop ebp
ret