Function at 0x10006a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1001022d], 0
jne 0x10007bd2
cmp dword [0x1001023c], 0
push ebx
push esi
push edi
mov byte [0x1001022b], 0
mov byte [0x1001022d], 1
jne 0x10006acc
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006a9f
nop dword [eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006a8e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006a8e
test ebx, ebx
js 0x10006a8e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006a85
nop dword [eax]
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006a8e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006a70
cmp byte [ecx + 0x10012178], 0
je 0x10006a98
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006a50
jmp 0x10006a9f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006aaa
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x1001296c
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006acc
push 0x1000bc90
push 3
push eax
mov ecx, 0x10010230
call fcn.1000f130
cmp dword [0x1001029c], 0
jne 0x10006b6c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006b3f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006b2e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006b2e
test ebx, ebx
js 0x10006b2e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006b25
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006b2e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006b10
cmp byte [ecx + 0x10012178], 0
je 0x10006b38
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006af3
jmp 0x10006b3f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006b4a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012974
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006b6c
push 0x1000c360
push 3
push eax
mov ecx, 0x10010290
call fcn.1000f130
cmp dword [0x100102fc], 0
jne 0x10006c0c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006bdf
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006bce
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006bce
test ebx, ebx
js 0x10006bce
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006bc5
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006bce
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006bb0
cmp byte [ecx + 0x10012178], 0
je 0x10006bd8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006b93
jmp 0x10006bdf
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006bea
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012984
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006c0c
push 0x1000c290
push 3
push eax
mov ecx, 0x100102f0
call fcn.1000f130
cmp dword [0x1001035c], 0
jne 0x10006cac
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006c7f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006c6e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006c6e
test ebx, ebx
js 0x10006c6e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006c65
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006c6e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006c50
cmp byte [ecx + 0x10012178], 0
je 0x10006c78
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006c33
jmp 0x10006c7f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006c8a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012994
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006cac
push 0x1000bd00
push 3
push eax
mov ecx, 0x10010350
call fcn.1000f130
cmp dword [0x100103bc], 0
jne 0x10006d4c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006d1f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006d0e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006d0e
test ebx, ebx
js 0x10006d0e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006d05
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006d0e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006cf0
cmp byte [ecx + 0x10012178], 0
je 0x10006d18
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006cd3
jmp 0x10006d1f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006d2a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x100125ac
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006d4c
push 0x1000cce0
push 3
push eax
mov ecx, 0x100103b0
call fcn.1000f130
cmp dword [0x1001041c], 0
jne 0x10006dec
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006dbf
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006dae
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006dae
test ebx, ebx
js 0x10006dae
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006da5
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006dae
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006d90
cmp byte [ecx + 0x10012178], 0
je 0x10006db8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006d73
jmp 0x10006dbf
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006dca
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012594
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006dec
push 0x1000c4a0
push 3
push eax
mov ecx, 0x10010410
call fcn.1000f130
cmp dword [0x1001047c], 0
jne 0x10006e8c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006e5f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006e4e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006e4e
test ebx, ebx
js 0x10006e4e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006e45
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006e4e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006e30
cmp byte [ecx + 0x10012178], 0
je 0x10006e58
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006e13
jmp 0x10006e5f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006e6a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012524
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006e8c
push 0x1000ca40
push 3
push eax
mov ecx, 0x10010470
call fcn.1000f130
cmp dword [0x100104dc], 0
jne 0x10006f2c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006eff
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006eee
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006eee
test ebx, ebx
js 0x10006eee
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006ee5
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006eee
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006ed0
cmp byte [ecx + 0x10012178], 0
je 0x10006ef8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006eb3
jmp 0x10006eff
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006f0a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x100129ac
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006f2c
push 0x1000c790
push 3
push eax
mov ecx, 0x100104d0
call fcn.1000f130
cmp dword [0x100106bc], 0
jne 0x10006fcc
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10006f9f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10006f8e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10006f8e
test ebx, ebx
js 0x10006f8e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10006f85
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x10006f8e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10006f70
cmp byte [ecx + 0x10012178], 0
je 0x10006f98
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006f53
jmp 0x10006f9f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10006faa
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x100129c8
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10006fcc
push 0x1000d910
push 3
push eax
mov ecx, 0x100106b0
call fcn.1000f130
cmp dword [0x1001071c], 0
jne 0x1000706c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000703f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000702e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000702e
test ebx, ebx
js 0x1000702e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007025
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x1000702e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007010
cmp byte [ecx + 0x10012178], 0
je 0x10007038
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10006ff3
jmp 0x1000703f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000704a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x100129dc
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000706c
push 0x1000db10
push 3
push eax
mov ecx, 0x10010710
call fcn.1000f130
cmp dword [0x1001077c], 0
jne 0x1000710c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100070df
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100070ce
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100070ce
test ebx, ebx
js 0x100070ce
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100070c5
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x100070ce
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100070b0
cmp byte [ecx + 0x10012178], 0
je 0x100070d8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007093
jmp 0x100070df
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100070ea
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x100129f0
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000710c
push 0x1000d6c0
push 3
push eax
mov ecx, 0x10010770
call fcn.1000f130
cmp dword [0x100107dc], 0
jne 0x100071ac
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000717f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000716e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000716e
test ebx, ebx
js 0x1000716e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007165
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x1000716e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007150
cmp byte [ecx + 0x10012178], 0
je 0x10007178
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007133
jmp 0x1000717f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000718a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012a00
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x100071ac
push 0x1000d240
push 3
push eax
mov ecx, 0x100107d0
call fcn.1000f130
cmp dword [0x1001059c], 0
jne 0x1000724c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000721f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000720e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000720e
test ebx, ebx
js 0x1000720e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007205
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x1000720e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100071f0
cmp byte [ecx + 0x10012178], 0
je 0x10007218
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100071d3
jmp 0x1000721f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000722a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012580
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000724c
push 0x1000d490
push 3
push eax
mov ecx, 0x10010590
call fcn.1000f130
cmp dword [0x1001053c], 0
jne 0x100072ec
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100072bf
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100072ae
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100072ae
test ebx, ebx
js 0x100072ae
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100072a5
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x100072ae
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007290
cmp byte [ecx + 0x10012178], 0
je 0x100072b8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007273
jmp 0x100072bf
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100072ca
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x1001256c
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x100072ec
push 0x1000c000
push 3
push eax
mov ecx, 0x10010530
call fcn.1000f130
cmp dword [0x100105fc], 0
jne 0x1000738c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000735f
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000734e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000734e
test ebx, ebx
js 0x1000734e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007345
nop
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x1000734e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007330
cmp byte [ecx + 0x10012178], 0
je 0x10007358
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007313
jmp 0x1000735f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000736a
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012540
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000738c
push 0x1000cfb0
push 3
push eax
mov ecx, 0x100105f0
call fcn.1000f130
cmp dword [0x1001065c], 0
jne 0x1000742f
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10007402
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100073f1
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100073f1
test ebx, ebx
js 0x100073f1
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100073e8
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x100073f1
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100073d3
cmp byte [ecx + 0x10012178], 0
je 0x100073fb
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100073b7
jmp 0x10007402
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000740d
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x10012554
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000742f
push 0x1000dd30
push 3
push eax
mov ecx, 0x10010650
call fcn.1000f130
cmp dword [0x1001083c], 0
jne 0x100074dc
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100074af
nop word [eax + eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000749e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000749e
test ebx, ebx
js 0x1000749e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007495
nop dword [eax]
movsx ax, byte [ecx + 0x10012178]
cmp word [edx], ax
jne 0x1000749e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007480
cmp byte [ecx + 0x10012178], 0
je 0x100074a8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007460
jmp 0x100074af
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100074ba
push 0x10012178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.NtDuplicateObject
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x100074dc
push 0x1000bcc0
push 3
push eax
mov ecx, 0x10010830
call fcn.1000f130
cmp dword [0x1001089c], 0
jne 0x1000757f
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10007552
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10007541
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10007541
test ebx, ebx
js 0x10007541
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007538
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x10007541
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007523
cmp byte [ecx + str.kernel32.dll], 0
je 0x1000754b
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007507
jmp 0x10007552
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000755d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.DebugActiveProcess
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000757f
push 0x1000b5c0
push 3
push eax
mov ecx, 0x10010890
call fcn.1000f130
cmp dword [0x100108fc], 0
jne 0x1000762c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100075ff
nop word [eax + eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100075ee
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100075ee
test ebx, ebx
js 0x100075ee
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100075e5
nop dword [eax]
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x100075ee
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100075d0
cmp byte [ecx + str.kernel32.dll], 0
je 0x100075f8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100075b0
jmp 0x100075ff
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000760a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.DebugActiveProcessStop
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000762c
push 0x1000b900
push 3
push eax
mov ecx, 0x100108f0
call fcn.1000f130
cmp dword [0x100109bc], 0
jne 0x100076cf
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100076a2
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10007691
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10007691
test ebx, ebx
js 0x10007691
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007688
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x10007691
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007673
cmp byte [ecx + str.kernel32.dll], 0
je 0x1000769b
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007657
jmp 0x100076a2
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100076ad
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.ContinueDebugEvent
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x100076cf
push 0x1000b2e0
push 3
push eax
mov ecx, 0x100109b0
call fcn.1000f130
cmp dword [0x1001095c], 0
jne 0x1000777c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000774f
nop word [eax + eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000773e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000773e
test ebx, ebx
js 0x1000773e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007735
nop dword [eax]
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x1000773e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007720
cmp byte [ecx + str.kernel32.dll], 0
je 0x10007748
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007700
jmp 0x1000774f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000775a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.WaitForDebugEvent
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000777c
push 0x1000e4c0
push 3
push eax
mov ecx, 0x10010950
call fcn.1000f130
cmp dword [0x10010a1c], 0
jne 0x1000781f
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100077f2
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100077e1
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100077e1
test ebx, ebx
js 0x100077e1
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100077d8
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x100077e1
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100077c3
cmp byte [ecx + str.kernel32.dll], 0
je 0x100077eb
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100077a7
jmp 0x100077f2
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100077fd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.DebugBreakProcess
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000781f
push 0x1000ba50
push 3
push eax
mov ecx, 0x10010a10
call fcn.1000f130
cmp dword [0x10010a7c], 0
jne 0x100078cc
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x1000789f
nop word [eax + eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x1000788e
mov edx, dword [edi + 0x28]
test edx, edx
je 0x1000788e
test ebx, ebx
js 0x1000788e
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007885
nop dword [eax]
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x1000788e
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007870
cmp byte [ecx + str.kernel32.dll], 0
je 0x10007898
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x10007850
jmp 0x1000789f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100078aa
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.CreateProcessA
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x100078cc
push 0x1000b500
push 3
push eax
mov ecx, 0x10010a70
call fcn.1000f130
cmp dword [0x10010adc], 0
jne 0x1000796f
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x10007942
movzx eax, word [edi + 0x24]
test ax, ax
je 0x10007931
mov edx, dword [edi + 0x28]
test edx, edx
je 0x10007931
test ebx, ebx
js 0x10007931
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x10007928
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x10007931
inc ecx
add edx, 2
cmp ecx, esi
jb 0x10007913
cmp byte [ecx + str.kernel32.dll], 0
je 0x1000793b
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100078f7
jmp 0x10007942
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000794d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.CreateProcessW
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x1000796f
push 0x1000b560
push 3
push eax
mov ecx, 0x10010ad0
call fcn.1000f130
cmp dword [0x10010b3c], 0
jne 0x10007a1c
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100079ef
nop word [eax + eax]
movzx eax, word [edi + 0x24]
test ax, ax
je 0x100079de
mov edx, dword [edi + 0x28]
test edx, edx
je 0x100079de
test ebx, ebx
js 0x100079de
mov esi, eax
xor ecx, ecx
shr esi, 1
je 0x100079d5
nop dword [eax]
movsx ax, byte [ecx + str.kernel32.dll]
cmp word [edx], ax
jne 0x100079de
inc ecx
add edx, 2
cmp ecx, esi
jb 0x100079c0
cmp byte [ecx + str.kernel32.dll], 0
je 0x100079e8
mov edi, dword [edi]
inc ebx
cmp edi, dword [ebp - 4]
jne 0x100079a0
jmp 0x100079ef
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x100079fa
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, str.IsWow64Process
mov ecx, eax
call fcn.10002cc0
test eax, eax
je 0x10007a1c
push 0x1000bc20
push 3
push eax
mov ecx, 0x10010b30
call fcn.1000f130
push 0x3738
call fcn.10001f40
mov esi, eax
add esp, 4
test esi, esi
je 0x10007ab8
lea ecx, [esi + 0x10]
mov dword [esi + 4], 0
lea eax, [esi + 0x2a20]
mov dword [esi + 8], 0
mov dword [esi], ecx
xorps xmm0, xmm0
mov dword [esi + 0xc], 0x2a00
mov dword [esi + 0x2a14], 0
mov dword [esi + 0x2a18], 0
mov dword [esi + 0x2a10], eax
mov dword [esi + 0x2a1c], 0xd00
movups xmmword [esi + 0x3720], xmm0
cmp dword [0x10011218], 0
jne 0x10007a9b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x64]
mov dword [0x10011218], eax
mov ecx, esi
mov dword [esi + 0x3730], 0
mov dword [esi + 0x3734], 0
call fcn.10004bb0
jmp 0x10007aba
xor esi, esi
push 0x68
mov dword [0x10010b94], esi
call fcn.10001f40
mov edi, eax
add esp, 4
test edi, edi
je 0x10007bb4
lea ebx, [edi + 0xc]
mov dword [ebx + 0x14], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx], 0x1388
mov eax, dword [0x7ffe0000]
mov dword [ebp - 4], eax
test eax, eax
je 0x10007b09
xor eax, eax
jmp 0x10007b16
mov eax, dword [0x7ffe0320]
mov dword [ebp - 4], eax
mov eax, dword [0x7ffe0324]
mov ecx, dword [0x7ffe0004]
xorps xmm0, xmm0
mul ecx
mov esi, eax
mov eax, dword [ebp - 4]
mul ecx
add esi, edx
shrd eax, esi, 0x18
add eax, ebx
or eax, 1
mov dword [ebx + 4], eax
movups xmmword [edi + 0x2c], xmm0
cmp dword [0x10011218], 0
jne 0x10007b54
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x64]
mov dword [0x10011218], eax
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x58], 0xffffffff
mov dword [edi + 0x54], 0xffffffff
mov dword [edi + 0x64], 0xffffffff
mov byte [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi], 0xffffffff
mov dword [edi + 4], 0
mov dword [edi + 8], 0x1388
jmp 0x10007bb6
xor edi, edi
push 0x10012790
push str._s_Enabled_n
mov dword [0x10010b90], edi
call dword [fcn.10010bf8]
add esp, 8
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret