Function at 0x12db6500
Capabilities:
Accept command line arguments
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x130582d4
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x13199a0c], ebp
call fcn.12f9c6f0
test eax, eax
mov edi, 1
je 0x12db6544
call fcn.12e30170
test eax, eax
jne 0x12db6544
mov dword [0x13199a0c], edi
mov eax, dword [0x13199068]
or ebx, 0xffffffff
cmp eax, ebp
je 0x12db6577
mov eax, dword [0x13199a0c]
cmp eax, ebp
mov eax, 0x130d5030
jne 0x12db6563
mov eax, 0x130d5024
push eax
push str.Dll_Attach__Vista_Session0____s_
push 0x130c6b6c
push ebx
call fcn.12dad750
add esp, 0x10
push 0x130ccfe0
push str.Hookapi
mov ecx, 0x13198fd8
call fcn.12dad2e0
push ebp
push str.OAGENT3
call fcn.12f94b30
lea eax, [esp + 0x140]
push eax
call fcn.12e31de0
mov ecx, dword [0x13199068]
add esp, 0xc
cmp ecx, ebp
je 0x12db65c4
push eax
push str.DllProcAttach__bGet_:__d_
push str.docrule
push ebx
call fcn.12dad750
add esp, 0x10
call fcn.12e32320
call fcn.12e36a60
call fcn.12e9a4e0
call fcn.12f9c5b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x25c]
push eax
push ecx
call fcn.12d8ec40
add esp, 8
call fcn.12d921a0
cmp dword [0x13199068], ebp
je 0x12db6616
mov edx, dword [0x13196dcc]
push edx
push str.DllProcAttach__appname_:__s_
push str.AppName
push ebx
call fcn.12dad750
add esp, 0x10
mov dword [esp + 0x78], ebp
call fcn.12ebf8b0
test eax, eax
je 0x12db6652
push 4
call fcn.12f5c05b
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebp
mov dword [esp + 0x254], ebp
je 0x12db6645
mov ecx, eax
call fcn.12ebadf0
jmp 0x12db6647
xor eax, eax
mov dword [esp + 0x254], ebx
mov dword [esp + 0x78], eax
call fcn.12db2520
mov edx, dword [0x13199068]
mov ecx, dword [0x13196dcc]
mov eax, dword [0x13196dd0]
cmp edx, ebp
mov dword [esp + 0x48], ecx
je 0x12db6697
cmp eax, ebp
jne 0x12db6679
mov eax, 0x130c8c0c
cmp ecx, ebp
jne 0x12db6682
mov ecx, 0x130c8c0c
push eax
push ecx
push str.Dll_Attach__name:__s___path:__s_
push 0x130c6b6c
push ebx
call fcn.12dad750
add esp, 0x14
push ebp
call fcn.12f29120
add esp, 4
call fcn.12f26810
call fcn.12d8a0c0
mov ecx, 0x131b63a8
call fcn.12e57f20
call fcn.12e6f0c0
push ebp
call sym.winahdcore32.dll_InitRecordMgr
push ebp
call sym.winahdcore32.dll_InitShareInfoMgr
push ebp
call fcn.12edb1f0
push 0x20000
call fcn.12e6efd0
add esp, 8
test eax, eax
je 0x12db66e6
mov ecx, 0x131c0930
call fcn.12ec9330
push ebp
mov ecx, 0x131c0930
call fcn.12ebfbe0
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
je 0x12db6752
mov ecx, 0x131c0930
call fcn.12ecaa50
mov ecx, 0x131c0930
call fcn.12ec4ba0
mov ecx, 0x131c0930
call fcn.12ec8150
mov ecx, 0x131c0930
call fcn.12ec83e0
mov ecx, 0x131c0930
call fcn.12ec8b00
mov ecx, 0x131c0930
call fcn.12ec0c70
mov ecx, 0x131c0930
call fcn.12ec0d80
mov ecx, 0x131c0930
call fcn.12ec4fe0
push ebp
call fcn.12ec2610
add esp, 4
cmp eax, edi
mov dword [esp + 0x70], ebp
jne 0x12db6767
mov dword [esp + 0x70], edi
push 0x20000
xor esi, esi
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12db679a
push edi
mov ecx, 0x131c0930
call fcn.12ebfbe0
test eax, eax
je 0x12db681f
call fcn.12d91c00
test eax, eax
jne 0x12db681f
call fcn.12e75110
mov esi, eax
mov eax, dword [0x13199a0c]
cmp eax, ebp
je 0x12db67b7
push ebp
mov ecx, 0x13196d48
call fcn.12d8d920
mov esi, eax
mov ecx, 0x131c0930
call fcn.12ec4040
mov ecx, 0x131c09d8
call fcn.12ee6380
push esi
mov ecx, 0x131c09d8
call fcn.12ee6630
mov ecx, 0x131c09d8
call fcn.12ee6680
push esi
mov ecx, 0x131c0934
call fcn.12ee6630
mov ecx, 0x131c0934
call fcn.12ee6670
mov ecx, 0x131c13e0
call fcn.12ed3230
mov ecx, 0x131c13e0
call fcn.12ed7e90
mov ecx, 0x131c13e0
call fcn.12ed8230
mov ecx, 0x131c13e0
call fcn.12ed86d0
mov esi, edi
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
je 0x12db6856
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12db6856
push edi
mov ecx, 0x131c0930
call fcn.12ebfbe0
test eax, eax
je 0x12db6876
call fcn.12d91c00
test eax, eax
jne 0x12db6876
call fcn.12d91c00
test eax, eax
jne 0x12db6876
mov eax, dword [0x13196dd0]
mov ecx, dword [0x13196dcc]
push eax
push ecx
mov ecx, 0x131bf458
call fcn.12eb3b60
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
je 0x12db688c
cmp esi, ebp
je 0x12db6931
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push edi
push ebp
push ecx
mov dword [esp + 0x260], edi
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x130764dc
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 1
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12db6921
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 1
call fcn.12e9c5f0
cmp eax, ebp
jne 0x12db691b
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 1
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db6921
mov dword [0x1319a228], edi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], ebx
call fcn.12e9c070
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push edi
push ebp
push ecx
mov dword [esp + 0x260], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076494
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 5
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12db69d0
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 5
call fcn.12e9c5f0
cmp eax, ebp
jne 0x12db69c4
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 5
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db69d0
mov dword [0x13108c28], ebp
mov dword [0x1319a228], ebp
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], ebx
call fcn.12e9c070
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push edi
push ebp
push ecx
mov dword [esp + 0x260], 9
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076530
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 9
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c180
test eax, eax
je 0x12db6a7b
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 9
call fcn.12e9c5f0
cmp eax, ebp
jne 0x12db6a73
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 9
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db6a7b
mov dword [0x1319a22c], edi
jmp 0x12db6a87
cmp dword [0x1319a22c], ebp
je 0x12db6b2c
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push edi
push ebp
push ecx
mov bl, 0xd
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076594
mov byte [esp + 0x264], bl
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12db6b1b
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
cmp eax, ebp
jne 0x12db6b15
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db6b1b
mov dword [0x1319a22c], ebp
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 9
call fcn.12e9c070
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], 0xffffffff
call fcn.12e9c070
mov ecx, 0x82
xor eax, eax
mov edi, 0x13199a2c
push 0x130d4ee8
rep stosd dword es:[edi], eax
call fcn.12d8c620
push eax
push 0x130c4e18
push 0x13199a2c
call fcn.12f5cfbf
add esp, 0x10
call fcn.12f9c520
test eax, eax
je 0x12db6b9f
mov ecx, 0x82
xor eax, eax
mov edi, 0x13199c34
push 0x130d4ec4
rep stosd dword es:[edi], eax
call fcn.12d8ba90
push eax
push 0x130c4e18
push 0x13199c34
call fcn.12f5cfbf
add esp, 0x10
call fcn.12e5bcf0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
push 0x4ff
mov ecx, 0x131b5f30
push str.G:WorkshopAgentDevelopProjCodePreReleaseHOOKAPI4.84.111.0DetoursProjectDetoursEntityNTDetoursEntityNT.cpp
push esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], 2
call fcn.12f568c0
mov edi, eax
mov dword [esp + 0xbc], edi
push 1
push ebp
push ecx
mov ebx, 0x11
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinj_external_crypt
mov dword [esp + 0x264], ebx
call fcn.12f46b50
mov ecx, 0x13199fa0
mov byte [esp + 0x260], bl
call fcn.12e9c110
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinj_external
call fcn.12f46b50
mov ecx, 0x13199f00
mov byte [esp + 0x260], bl
call fcn.12e9c110
cmp edi, ebp
mov dword [esp + 0x254], 0xffffffff
je 0x12db6c53
push esi
mov ecx, 0x131b5f30
call fcn.12f56b40
call fcn.12e4c230
call fcn.12d92050
mov dword [0x131999d8], eax
call fcn.12db6060
call fcn.12db60e0
mov ebx, 1
lea ecx, [esp + 0x20]
mov dword [0x130cf408], ebx
mov dword [0x130cf40c], ebx
mov dword [0x131999e0], ebp
call fcn.12e9bf00
push ebx
push ebp
push ecx
mov dword [esp + 0x260], 0x14
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_inj21_mode
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 0x14
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.12e9c180
test eax, eax
je 0x12db6cee
cmp esi, ebx
jne 0x12db6ce3
mov dword [0x130cf40c], ebp
jmp 0x12db6cee
cmp esi, 2
jne 0x12db6cee
mov dword [0x130cf408], ebp
call fcn.12f9d400
test eax, eax
je 0x12db6d62
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov bl, 0x16
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.injectdriver_safemode
mov byte [esp + 0x264], bl
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
cmp eax, ebp
je 0x12db6d48
cmp eax, 1
jne 0x12db6d4e
mov dword [0x130cf40c], ebp
lea ecx, [esp + 0x8c]
mov byte [esp + 0x254], 0x14
call fcn.12e9c070
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db6d8e
mov edx, dword [0x130cf408]
mov eax, dword [0x130cf40c]
push edx
push eax
push edi
push esi
push str.DllProcAttach_Inject21_Mode___d___08x____d__d_
push str.Inject
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov bl, 0x18
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.injectdriver_dis
mov byte [esp + 0x264], bl
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db6df6
mov ecx, dword [esp + 0x6c]
or edi, 0xffffffff
push ecx
push esi
push str.DllProcAttach_TIjtDrv__Config__1___d____08x_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x14
jmp 0x12db6df9
or edi, 0xffffffff
cmp esi, ebp
je 0x12db6e02
cmp esi, 1
jne 0x12db6e2f
mov eax, dword [0x13199068]
mov dword [0x131999e0], 1
cmp eax, ebp
mov dword [0x130cf40c], ebp
je 0x12db6e2f
push ebp
push str.DllProcAttach_TIjtDrv__Config__2__________d_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x14
call fcn.12e9c070
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
call fcn.12e752d0
test al, 8
je 0x12db6e7e
cmp dword [0x13199068], ebp
je 0x12db6e74
push str.DllProcAttach_Inject1.5
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0xc
mov dword [0x131999dc], 1
lea ecx, [esp + 0x20]
mov dword [0x131999e4], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x1a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hook_createprocessret_filter
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db6eea
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_CreaterPRetfilter__Config__1___d____08x_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db6ef3
mov eax, esi
jmp 0x12db6ef5
xor eax, eax
mov ecx, dword [0x13199068]
mov dword [0x131999e4], eax
cmp ecx, ebp
je 0x12db6f18
push eax
push str.DllProcAttach_CreaterPRetfilter__Config__2__________d_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x1c
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tfw_enumfilter_proc
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12db6f95
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
mov dword [0x13199e60], eax
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tfw_createwndfilter_proc
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12db6fef
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
mov dword [0x13199e64], eax
jmp 0x12db704c
mov eax, dword [0x13196dcc]
lea ecx, [esp + 0x18]
push eax
call fcn.12f46b50
mov ecx, dword [esp + 0x18]
push str.alias.exe
push ecx
mov byte [esp + 0x25c], 0x21
call fcn.12f5e2a4
add esp, 8
cmp eax, ebp
je 0x12db7032
mov edx, dword [esp + 0x18]
push str.teamcenter.exe
push edx
call fcn.12f5e2a4
add esp, 8
cmp eax, ebp
jne 0x12db703c
mov dword [0x13199e64], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], bl
call fcn.12f472f0
cmp dword [0x13199068], ebp
je 0x12db7074
mov eax, dword [0x13199e60]
mov ecx, dword [0x13199e64]
push eax
push ecx
push str.DllProcAttach__TFWCreateWndFilter:__d___TFWEnumFilter:__d_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
cmp dword [0x130cf41c], ebp
je 0x12db70a2
call fcn.12f9c520
test eax, eax
jne 0x12db70a2
push str.tsysdrv.dll
call fcn.12ff89e0
add esp, 4
push str.FindNextFileW
push str.Kernel32.dll
call fcn.12f29650
push str.ShellExecuteExW
push str.Shell32.dll
mov dword [0x1319a220], eax
call fcn.12f29650
add esp, 0x10
mov dword [0x1319a224], eax
call fcn.12d91c00
test eax, eax
jne 0x12db70ea
mov edx, dword [0x13196dcc]
push edx
call fcn.12e0f5e0
add esp, 4
call fcn.12e0f710
call fcn.12d91a00
test eax, eax
jne 0x12db70fc
call fcn.12d91c60
test eax, eax
je 0x12db7111
push 1
call fcn.12e0aae0
mov eax, dword [0x13196dcc]
push eax
call fcn.12e0aaf0
add esp, 8
call fcn.12d91c80
test eax, eax
je 0x12db7130
push 1
call fcn.12e0aba0
mov ecx, dword [0x13196dcc]
push ecx
call fcn.12e0abb0
add esp, 8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x149]
mov byte [esp + 0x148], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x148]
push 0x104
stosb byte es:[edi], al
mov eax, dword [0x13196dd0]
push edx
push 0xffffffffffffffff
push eax
call fcn.12e2f7e0
mov edx, dword [0x13196dc4]
add esp, 0x10
lea ecx, [esp + 0x148]
push ecx
push edx
mov ecx, 0x131b7f0c
call fcn.12e63bc0
lea eax, [esp + 0x148]
mov ecx, 0x131b7f0c
push eax
call fcn.12e63e10
test eax, eax
je 0x12db71a9
lea ecx, [esp + 0x148]
push ecx
mov ecx, 0x131b7f0c
call fcn.12e63eb0
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12db7217
push str.adb.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12db7217
call fcn.12f293c0
mov ebx, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db71e8
push ebx
push str.DllProcAttach_1_Flags:_0x_08x
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test bl, 8
jne 0x12db7217
or ebx, 8
push ebx
call fcn.12f293a0
mov eax, dword [0x13199068]
add esp, 4
cmp eax, ebp
je 0x12db7217
push ebx
push str.DllProcAttach_2_Flags:_0x_08x
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
call fcn.12d92b60
test eax, eax
je 0x12db7225
call fcn.12eaa880
mov edi, 1
mov dword [esp + 0x80], edi
call fcn.12d91a00
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x12db72f6
call fcn.12eaa880
call fcn.12da33b0
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
push edi
push ebp
push ecx
mov ebx, 0x22
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Disable_SaveAsFileCheck
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
cmp eax, edi
mov dword [0x130cf410], ebp
je 0x12db72a8
mov dword [0x130cf410], edi
or edi, 0xffffffff
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, edi
mov dword [0x130d0b50], eax
je 0x12db72d5
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call esi
cmp eax, ebp
je 0x12db72f9
push str._SEPARATE
push eax
call fcn.12f5c53a
add esp, 8
test eax, eax
je 0x12db72f9
mov dword [esp + 0x80], ebp
jmp 0x12db72f9
or edi, 0xffffffff
call esi
cmp eax, ebp
je 0x12db731b
push str.__channel
push eax
call fcn.12f5c53a
add esp, 8
test eax, eax
je 0x12db731b
mov dword [0x13199a1c], 1
call fcn.12e394d0
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov dword [esp + 0x260], 0x24
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_dis
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x24
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7386
mov edx, dword [esp + 0x6c]
push edx
push esi
push str.DllProcAttach_UpDown_Log_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db7396
mov dword [0x131999e8], esi
jmp 0x12db7489
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_filter
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x24
call fcn.12e9c110
mov eax, dword [0x1307d24c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov bl, 0x27
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5d0
cmp dword [0x13199068], ebp
je 0x12db7400
mov edx, dword [esp + 0x18]
push esi
push edx
push str.DllProcAttach_UpDown_Log_Filter___s___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db7430
mov dword [0x131999e8], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], 0x24
call fcn.12f472f0
cmp dword [0x131999e8], ebp
jne 0x12db7489
mov ebx, dword [0x13196dcc]
mov dword [esp + 0x1c], str.i4tools.exe
cmp ebx, ebp
je 0x12db7489
xor esi, esi
lea edi, [esp + 0x1c]
mov eax, dword [edi]
push ebx
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12db747c
inc esi
add edi, 4
cmp esi, 1
jl 0x12db7461
jmp 0x12db7486
mov dword [0x131999e8], 1
or edi, 0xffffffff
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x29
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_ctrl_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db74ff
mov ecx, dword [esp + 0x6c]
push ecx
push esi
push str.DllProcAttach_UpDown_Ctrl_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db750f
mov dword [0x131999ec], esi
jmp 0x12db75b9
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_ctrl_filter
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
mov edx, dword [0x1307d24c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x258], 0x2c
call fcn.12e9c5d0
cmp dword [0x13199068], ebp
je 0x12db7578
mov ecx, dword [esp + 0x18]
push esi
push ecx
push str.DllProcAttach_UpDown_Ctrl_Filter___s___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 0x2c
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db75a9
mov dword [0x131999ec], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], bl
call fcn.12f472f0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
mov ecx, 0x131c7c28
call fcn.12f20290
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x2e
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_dis_updown_options
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7639
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_UpDown_Ctrl_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
mov dword [0x130cf414], ebp
je 0x12db764e
mov dword [0x130cf414], 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
cmp dword [0x131999e8], ebp
jne 0x12db766b
call fcn.12f04ee0
cmp dword [0x131999ec], ebp
jne 0x12db7678
call fcn.12f0d620
call fcn.12f0f0e0
mov ecx, 0x131b6190
call fcn.12e57ab0
mov ecx, 0x13197e08
call fcn.12d9d8a0
call fcn.12f032b0
lea ecx, [esp + 0x20]
mov dword [0x13199a14], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x30
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.shelllog_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7702
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_ShellLog_Log_Dis___d___08x_
push str.ShellLog
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db770d
mov dword [0x131999f0], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x32
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ifo_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7783
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_IFO_Dis___d___08x_
push 0x130d487c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db778e
mov dword [0x131999f4], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x34
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_oeawatermask_disable
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7804
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach__OeaWM_dis___d___08x_
push str.PrintRule
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db780f
mov dword [0x13199a10], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
mov dword [esp + 0x88], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x36
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_format_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db788c
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_Format_dis___d___08x_
push str.HookFormat
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db7898
mov dword [esp + 0x88], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x38
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_flushbuffer
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db790e
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_FlushBuffer___d___08x_
push str.DoEncrypt
push edi
call fcn.12dad750
add esp, 0x14
mov ebx, 1
cmp esi, ebx
je 0x12db7930
call fcn.12e754f0
cmp eax, 0x654d
je 0x12db7930
cmp esi, 2
jne 0x12db7936
mov dword [0x130cf418], ebp
jmp 0x12db7936
mov dword [0x130cf418], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
push ebx
push ebp
push ecx
mov dword [esp + 0x80], ebp
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterdll
call fcn.12f46b50
mov ecx, 0x1319a098
mov dword [esp + 0x260], edi
call fcn.12e9c110
mov eax, dword [0x13199068]
mov esi, dword [0x1319a0b8]
cmp eax, ebp
je 0x12db7994
push esi
push str.DllProcAttach_FilterDll__d
push str.FilterDll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
je 0x12db79a0
mov dword [esp + 0x74], ebx
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x3b
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.traceall
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
mov eax, dword [0x13199068]
mov ecx, dword [esp + 0x40]
cmp eax, ebp
mov esi, ecx
je 0x12db79fc
push ecx
push str.DllProcAttach_TraceAll_01__08x
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
jne 0x12db7a7c
mov ecx, 0x131a8d60
call fcn.12e033c0
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7a2d
push esi
push str.DllProcAttach_TraceAll_02__d
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, ebp
jne 0x12db7a7c
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db7a7c
mov ecx, 0x131a8d60
call fcn.12e033b0
cmp dword [0x13199068], ebp
je 0x12db7a7c
push str.DllProcAttach_TraceAll_03
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
mov esi, 1
mov ebx, 0x3e
push esi
push ebp
push ecx
mov dword [esp + 0x260], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.doclog_dis
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
cmp eax, esi
jne 0x12db7ae5
mov dword [0x13199a20], esi
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
push esi
push ebp
push ecx
mov dword [esp + 0x260], 0x40
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.upload_control_mode
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], 0x40
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
mov ecx, dword [0x13199068]
mov dword [0x13199e48], eax
cmp ecx, ebp
je 0x12db7b65
push eax
push str.DllProcAttach_UploadControlMode:_d
push str.TUploadCtrl
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
push esi
push ebp
push ecx
mov ebx, 0x42
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.uploadfile_control
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
cmp eax, esi
jne 0x12db7bce
mov dword [0x130cf420], esi
jmp 0x12db7bdc
xor edx, edx
cmp eax, 2
setne dl
mov dword [0x130cf420], edx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
call fcn.12d91e40
test eax, eax
jne 0x12db7c01
call fcn.12d91fe0
test eax, eax
je 0x12db7c6e
lea ecx, [esp + 0x8c]
call fcn.12e9bf00
push esi
push ebp
push ecx
mov ebx, 0x44
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ie_uploadlog_record_apicom
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x8c]
call fcn.12e9c670
cmp eax, esi
mov dword [0x13199e4c], esi
je 0x12db7c5b
mov dword [0x13199e4c], ebp
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
call fcn.12db2670
mov dword [0x131999f8], esi
call fcn.12d91a00
test eax, eax
je 0x12db7d0c
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x46
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_ext_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7cec
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_UDisk_Ctrl_Ext_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7cf7
mov dword [0x131999f8], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
mov esi, 1
cmp dword [0x13199068], ebp
je 0x12db7d2e
mov ecx, dword [0x131999f8]
push ecx
push str.DllProcAttach_UDisk_Ctrl_Ext_Dis_2___d_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x10
mov dword [0x131999fc], esi
call fcn.12f9c6f0
test eax, eax
je 0x12db7dd4
call fcn.12f9c520
test eax, eax
je 0x12db7dd4
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x48
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_Getpathfromhandle_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7db4
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7dbf
mov dword [0x131999fc], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
mov esi, 1
call fcn.12e39c10
mov dword [0x13199a00], esi
call fcn.12f9c6f0
test eax, eax
je 0x12db7e83
call fcn.12d91a00
test eax, eax
jne 0x12db7e02
call fcn.12d92b60
test eax, eax
je 0x12db7e83
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x4a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_SHSimulate_dis
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7e68
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7e73
mov dword [0x13199a00], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
mov dword [0x13199a04], ebp
call fcn.12d91a00
test eax, eax
je 0x12db7f52
lea ecx, [esp + 0x20]
xor esi, esi
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x4c
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UDiskRuleOutgo
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
mov eax, dword [esp + 0x40]
cmp eax, 0xf0000001
mov edi, eax
jne 0x12db7efb
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
cmp esi, 1
je 0x12db7f13
cmp esi, 2
jne 0x12db7efb
mov dword [0x13199a04], ebp
jmp 0x12db7f1d
mov dword [0x13199a04], ebp
call fcn.12e754f0
push eax
call fcn.12e64de0
add esp, 4
test eax, eax
je 0x12db7f1d
mov dword [0x13199a04], 1
cmp dword [0x13199068], ebp
je 0x12db7f3b
push edi
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], 0xffffffff
call fcn.12e9c070
or edi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x4e
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_addudlog
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db7fb8
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_AddUDLog___d___08x_
push str.udlog
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7fd7
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12db7fe1
push str.sogouexplorer.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12db7fe1
mov dword [0x13199a08], 1
cmp dword [0x13199068], ebp
je 0x12db8003
mov edx, dword [0x13199a08]
push edx
push str.DllProcAttach_AddUDLog__g_bAddUDLog:_d_
push str.udlog
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x50
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_passielog
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
mov eax, dword [0x13199068]
mov ecx, dword [esp + 0x40]
cmp eax, ebp
mov esi, ecx
je 0x12db806f
push ecx
push str.DllProcAttach_PassIELog_1___lu_
push 0x130d43e8
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
jne 0x12db80a3
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov ecx, dword [0x13199068]
mov dword [0x13199a28], eax
cmp ecx, ebp
je 0x12db80a3
push eax
push str.DllProcAttach_PassIELog_2___lu_
push 0x130d43e8
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x52
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.dishook_msi
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db811d
mov eax, dword [esp + 0x6c]
push eax
push esi
push str.DllProcAttach_DisHook_msi___d___08x_
push 0x130d4350
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db8128
mov dword [esp + 0x44], esi
jmp 0x12db815a
cmp esi, 2
je 0x12db8156
mov dword [esp + 0x44], 1
call fcn.12d91a00
test eax, eax
jne 0x12db8156
mov ecx, dword [0x13196dcc]
push str.SystemSettings.exe
push ecx
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12db815a
mov dword [esp + 0x44], ebp
mov edx, dword [0x13196dcc]
push str.java.exe
push edx
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12db81b9
mov eax, dword [0x13196dcc]
push str.javaw.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12db81b9
mov ecx, dword [0x13196dcc]
push str.studio.exe
push ecx
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12db81b9
mov edx, dword [0x13196dcc]
push str.studio64.exe
push edx
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12db81c1
mov dword [esp + 0x44], 1
mov ecx, dword [0x13196dcc]
lea eax, [esp + 0x44]
push eax
push ecx
call fcn.12db6280
mov eax, dword [esp + 0x4c]
add esp, 8
cmp eax, ebp
jne 0x12db822f
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_msi_filter
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db822f
mov dword [esp + 0x44], 1
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
mov dword [0x13199e40], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x56
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_escape
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db82ab
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_hookescape___d___08x_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db82b6
mov dword [0x13199e40], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
lea ecx, [esp + 0x20]
mov dword [0x13199e44], ebp
call fcn.12e9bf00
push 1
push ebp
push ecx
mov ebx, 0x58
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_watermark_xor_mode
mov dword [esp + 0x264], ebx
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x20]
call fcn.12e9c670
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db8332
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_WaterMark_Xor_Mode___d___08x_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, ebp
jbe 0x12db833c
mov dword [0x13199e44], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c070
mov ecx, 0x13198808
call fcn.12da1630
mov ecx, 0x131bcc08
call fcn.12e88210
mov ecx, dword [0x13196dcc]
push ecx
call fcn.12e11530
add esp, 4
call fcn.12e12170
call fcn.12eae010
mov ecx, 0x131a9198
call fcn.12e0adf0
push 1
push edi
mov ecx, 0x131bf108
call fcn.12eaf9a0
push 1
lea ecx, [esp + 0xcc]
call fcn.12dac640
lea ecx, [esp + 0xf8]
mov dword [esp + 0x254], 0x5a
call fcn.12e380e0
mov edx, dword [0x13196dcc]
lea ecx, [esp + 0xf8]
push edx
mov byte [esp + 0x258], 0x5b
call fcn.12e38e60
mov dword [esp + 0xc0], eax
mov eax, dword [0x130d2abc]
cmp eax, ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x18], ebp
jbe 0x12dba2ab
cmp dword [esp + 0xc0], ebp
je 0x12db84a1
mov esi, dword [esp + 0x18]
mov eax, dword [0x130d2ab8]
shl esi, 5
mov ecx, dword [esi + eax + 4]
push ecx
lea ecx, [esp + 0xb4]
call fcn.12f469f0
mov edx, dword [0x130d2ab8]
mov edi, dword [eax]
lea ecx, [esp + 0xc4]
mov byte [esp + 0x254], 0x5c
mov eax, dword [esi + edx]
push eax
call fcn.12f469f0
mov eax, dword [eax]
lea ecx, [esp + 0x84]
push ecx
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x260], 0x5d
call fcn.12e38bd0
lea ecx, [esp + 0xc4]
mov edi, eax
mov byte [esp + 0x254], 0x5c
call fcn.12f472f0
lea ecx, [esp + 0xb0]
mov byte [esp + 0x254], 0x5b
call fcn.12f472f0
cmp dword [esp + 0x84], ebp
je 0x12db84a1
mov eax, dword [0x130d2ab8]
xor edx, edx
cmp edi, ebp
sete dl
mov dword [esi + eax + 0x10], edx
jmp 0x12dba291
mov edi, dword [esp + 0x18]
mov ecx, dword [0x130d2ab8]
mov esi, edi
shl esi, 5
mov edx, dword [esi + ecx + 4]
lea ecx, [esp + 0xc8]
push edx
call fcn.12dac7f0
test eax, eax
jne 0x12db84d7
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
jmp 0x12dba291
cmp dword [esp + 0x44], ebp
je 0x12db8521
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.msi.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8521
cmp dword [0x13199068], ebp
je 0x12db8514
push str.filter_msi.dll
push 0x130d4230
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
call fcn.12d92ed0
test eax, eax
je 0x12db858f
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d35c4
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db857c
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.FormatMessageA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db858f
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatMessageW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db858f
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], 3
jmp 0x12dba291
mov eax, dword [0x130d2ab8]
mov edx, dword [esi + eax + 0x18]
mov eax, dword [esi + eax + 4]
push edx
push eax
call fcn.12f26990
mov ecx, dword [0x130d2ab8]
add esp, 8
mov dword [esi + ecx + 0x18], eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db85e1
mov eax, dword [0x130d2ab8]
mov edx, dword [esi + eax + 0x18]
mov ecx, dword [esi + eax + 4]
push edx
mov edx, dword [esi + eax]
push ecx
push edx
push edi
push str.DllProcAttach__i___d____S____S____08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
call fcn.12d91ba0
test eax, eax
je 0x12db85fa
mov eax, dword [0x130d2ab8]
mov ebx, 1
mov dword [esi + eax + 0x10], ebx
jmp 0x12db85ff
mov ebx, 1
call fcn.12d920a0
test eax, eax
je 0x12db8754
cmp dword [0x13199068], ebp
je 0x12db8658
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 0x10]
mov edx, dword [esi + eax + 4]
mov eax, dword [esi + eax]
push ecx
push edx
push eax
push str.DllProcAttach___S____S____lu_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
mov eax, dword [0x13199068]
add esp, 0x18
cmp eax, ebp
je 0x12db8658
push str.DllProcAttach_1
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
push 0x130d3870
mov dword [esi + ecx + 0x10], ebx
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db86ed
mov ecx, dword [0x130d2ab8]
push 0x130d3858
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db86ed
mov eax, dword [0x130d2ab8]
push 0x130d3880
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db86ed
mov edx, dword [0x130d2ab8]
push str.CreateProcessWithTokenW
mov eax, dword [esi + edx + 4]
push eax
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db86ed
mov ecx, dword [0x130d2ab8]
push 0x130cfd18
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db86f6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov ecx, dword [0x130d2ab8]
push 0x130d3880
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db872d
call fcn.12f9c620
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
push 0x130d3858
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12f9c5e0
jmp 0x12db8717
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d3a3c
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8852
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DragQueryFileA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8814
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.DragQueryFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8814
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ShellExecuteExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHAddToRecentDocs
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db87f8
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHOpenPropSheetW
call fcn.12f5ed10
add esp, 8
jmp 0x12dba170
call fcn.12d91a00
test eax, eax
jne 0x12db8837
call fcn.12f9c6f0
test eax, eax
jne 0x12db8837
mov edx, dword [esp + 0x48]
push edx
call fcn.12f10290
add esp, 4
test eax, eax
jne 0x12db8840
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
call fcn.12d92ef0
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d3998
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db894b
call fcn.12d92070
test eax, eax
je 0x12db88a0
cmp dword [0x13199068], ebp
je 0x12db8896
push str.DllProcAttach__IE10After_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
call fcn.12d92110
test eax, eax
jne 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetOpenFileNameA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8920
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.GetOpenFileNameW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8920
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.GetSaveFileNameA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8920
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetSaveFileNameW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
cmp dword [0x13199068], ebp
je 0x12db893c
push str.DllProcAttach___IsGUIProgram_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.comctl32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db89d7
cmp dword [0x13199068], ebp
je 0x12db8982
push str.DllProcAttach__IE10After_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
call fcn.12d92110
test eax, eax
jne 0x12db8995
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.PropertySheetW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db89bb
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
mov eax, dword [0x130d2ab8]
cmp dword [esi + eax + 0x10], ebp
jne 0x12dba170
mov dword [esi + eax + 0x10], 4
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d391c
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8e21
cmp dword [0x13199068], ebp
je 0x12db8a12
push str.ntdll
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3900
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8a8e
call fcn.12f9c600
test eax, eax
je 0x12dba170
cmp dword [0x13199068], ebp
je 0x12db8a57
push str.ntdll_1
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
call fcn.12d92080
test eax, eax
je 0x12dba170
cmp dword [0x13199068], ebp
je 0x12db8a80
push str.ntdll_2
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d38cc
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8b86
call fcn.12d92390
test eax, eax
je 0x12db8ac0
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
push ebx
mov ecx, 0x131c0930
call fcn.12ebfbe0
test eax, eax
je 0x12db8ad9
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
lea ecx, [esp + 0x20]
call fcn.12e9bf00
push ebx
push ebp
push ecx
mov byte [esp + 0x260], 0x5e
mov ecx, esp
mov dword [esp + 0x28], esp
push str.hookapi_ntcreatefile_proc
call fcn.12f46b50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 0x5e
call fcn.12e9c110
mov edi, dword [esp + 0x40]
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 0x5e
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db8b49
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov dword [0x1319a234], ebx
cmp dword [0x13199068], ebp
je 0x12db8b70
mov eax, dword [0x130d2ab8]
push edi
mov ecx, dword [esi + eax + 0x10]
push ecx
push str.DllProcAttach_NTCreateFile_Hook___d____08x_
push 0x130d407c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x20]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c070
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d38f4
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8cb6
call fcn.12f9c880
test eax, eax
je 0x12db8bc2
call fcn.12d91a60
test eax, eax
je 0x12db8bc2
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edi, dword [esp + 0x48]
push edi
push str.rm.exe
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12db8bea
push edi
push str.mv.exe
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12db8bf4
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
push ebx
mov ecx, 0x131c0930
call fcn.12ebfbe0
test eax, eax
je 0x12db8c0c
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
push ebx
push ebp
push ecx
mov byte [esp + 0x260], 0x61
mov ecx, esp
mov dword [esp + 0x28], esp
push str.hookapi_ntopenfile_proc
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x61
call fcn.12e9c110
mov edi, dword [esp + 0x6c]
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.12f46b50
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 0x61
call fcn.12e9c5f0
cmp eax, ebp
je 0x12db8c7c
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov dword [0x1319a230], ebx
cmp dword [0x13199068], ebp
je 0x12db8ca0
mov edx, dword [0x1319a230]
push edi
push edx
push str.DllProcAttach_NTOpenFile_Hook___d____08x_
push str.docrule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c070
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.NtQueryDirectoryFile
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8cfc
call fcn.12d91a00
test eax, eax
je 0x12dba170
cmp dword [0x131a9414], ebp
jne 0x12db99fa
push 0x20000
call fcn.12e6efd0
add esp, 4
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LdrLoadDll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8d2e
call fcn.12d92340
test eax, eax
jne 0x12db99fa
call fcn.12d91f30
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.NtAlpcConnectPort
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8de6
call fcn.12d929c0
test eax, eax
je 0x12db8d62
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12db8d98
mov ecx, 0x131bf108
call fcn.12eaf900
test eax, eax
jne 0x12db8d8f
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12db8d8f
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
jne 0x12db8d98
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
cmp dword [0x13199068], ebp
je 0x12dba170
push 5
call fcn.12e6f220
add esp, 4
neg eax
sbb eax, eax
inc eax
push eax
push 0x20000
call fcn.12e6efd0
add esp, 4
mov ecx, 0x131bf108
push eax
call fcn.12eaf900
push eax
push str.DllProcAttach_NtAlpcConnectPortnt___d__d__d_
push 0x130d4230
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3890
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92090
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130c55d4
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db93f1
mov eax, dword [0x130d2ab8]
push 0x130d3880
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8e66
call fcn.12f9c620
test eax, eax
je 0x12db8e94
jmp 0x12db8e8a
mov eax, dword [0x130d2ab8]
push 0x130d3858
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8e94
call fcn.12f9c5e0
test eax, eax
je 0x12db8e94
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d91a00
test eax, eax
je 0x12db8ffb
cmp dword [esp + 0x80], ebp
je 0x12db8ffb
mov eax, dword [0x131999f8]
cmp eax, ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ReadFile
je 0x12db8f92
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReadFileEx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ReadFileScatter
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.WriteFile
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.WriteFileEx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.WriteFileGather
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SetEndOfFile
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8ffb
jmp 0x12db8ff1
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReadFileEx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ReadFileScatter
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SetEndOfFile
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db8ffb
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d91cc0
test eax, eax
jne 0x12db900d
call fcn.12d91ce0
test eax, eax
je 0x12db9032
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ReadFile
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9032
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12f9c6f0
test eax, eax
je 0x12db9268
call fcn.12f9c880
test eax, eax
je 0x12db910e
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateFileA
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9071
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3764
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db90ff
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReplaceFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db90ff
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDirectoryExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db90ff
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db90ff
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3770
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9191
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12db9191
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateFileA
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9134
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12f9c520
test eax, eax
je 0x12db9191
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.12f8c880
add esp, 4
test eax, eax
je 0x12db9191
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d37a0
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9188
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3788
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9191
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d37ac
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db91c8
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3794
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db91d2
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DeleteFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db925c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.RemoveDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db925c
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FindNextFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db925c
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.FindFirstFileExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db925c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9294
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12db9294
cmp dword [esp + 0x74], ebp
jne 0x12db9294
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.LoadLibraryExW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9294
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateThread
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db92cc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ExitThread
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db92fa
cmp dword [0x131a91c8], ebp
je 0x12db92fa
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12db92fa
push str.Capture_
push str.FastCopy
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.SetVolumeMountPointW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9328
call fcn.12d92240
test eax, eax
je 0x12db9328
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
call fcn.12d92270
test eax, eax
je 0x12db9372
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.RemoveDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9368
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9372
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d91a00
test eax, eax
jne 0x12db93a0
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DeviceIoControl
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db93a0
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d92090
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3654
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3644
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d35c4
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9641
call fcn.12f9c6f0
test eax, eax
je 0x12db95ee
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DeleteFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db94a7
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.RemoveDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db94a7
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FindNextFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db94a7
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FindFirstFileExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db94a7
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDirectoryW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db94b1
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
cmp dword [esp + 0x74], ebp
je 0x12db94c9
call fcn.12f9c880
test eax, eax
je 0x12db94ee
call fcn.12f9c520
test eax, eax
je 0x12db94ee
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LoadLibraryExW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db94ee
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12f9c880
test eax, eax
je 0x12db95ee
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3764
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReplaceFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDirectoryExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3788
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3770
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CopyFile2
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateFile2
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db95ee
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatMessageA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db962a
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FormatMessageW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92eb0
test eax, eax
jne 0x12db8e13
call fcn.12d92ed0
jmp 0x12db8e0b
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.ws2_32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db96d5
cmp dword [0x131999ec], ebp
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.connect
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db871f
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.WSAConnect
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db871f
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.shutdown
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d357c
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9a4a
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.gdi32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9a4a
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.user32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9a4a
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.Msimg32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9a4a
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.fmifs.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db97df
call fcn.12d91a00
test eax, eax
je 0x12dba170
cmp dword [esp + 0x88], ebp
je 0x12db97a5
cmp dword [0x13199068], ebp
je 0x12dba170
push str.DllProcAttach_Format_dis_
push str.HookFormat
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatEx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db8e13
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FormatEx2
call fcn.12f5ed10
jmp 0x12db9997
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.ssleay32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db983a
call fcn.12d91a40
test eax, eax
je 0x12db9824
call fcn.12e562a0
test eax, eax
jne 0x12db8e13
push ebp
call fcn.12e563e0
and eax, 0x20
add esp, 4
cmp al, 0x20
je 0x12db8e13
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.tray.exe
jmp 0x12db9991
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.wininet.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.srvcli.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db987d
call fcn.12d920e0
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.ShLwApi.dll
call fcn.12f5ed10
mov edx, dword [0x130d2ab8]
add esp, 8
test eax, eax
jne 0x12db994b
mov eax, dword [esi + edx + 4]
push eax
push str.SHCreateStreamOnFileW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db98de
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.wmplayer.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SHCreateStreamOnFileEx
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9919
call fcn.12d91a00
test eax, eax
je 0x12dba170
call fcn.12f9c6f0
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SHSimulateDrop
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov eax, dword [esi + edx]
push eax
push str.Mfplat.dll
call fcn.12f5ed10
mov ecx, dword [0x130d2ab8]
add esp, 8
test eax, eax
jne 0x12db99b0
mov edx, dword [esi + ecx + 4]
push edx
push str.MFBeginCreateFile
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.wmplayer.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov edx, dword [esi + ecx]
push edx
push str.windows.storage.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
mov eax, dword [0x130d2ab8]
jne 0x12db9a2a
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHFileOperationWithAdditionalFlags
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9a09
call fcn.12f9c880
test eax, eax
je 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHCreateItemFromParsingName
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12db99e0
mov ecx, dword [esi + eax]
push ecx
push 0x130d3600
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92090
jmp 0x12db99f2
call fcn.12d91bc0
test eax, eax
jne 0x12db9ebd
call fcn.12f9c520
test eax, eax
je 0x12db9a6d
call fcn.12d91de0
test eax, eax
jne 0x12db9ebd
call fcn.12d92010
test eax, eax
jne 0x12db9ebd
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push 0x130d357c
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.gdi32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9ba0
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.StartDocW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.EndPage
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.StartPage
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDCW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDCA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.EndDoc
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.Escape
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ExtEscape
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d92250
test eax, eax
je 0x12db9bf3
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.gdi32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9bf3
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.BitBlt
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9bf3
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.user32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDialogIndirectParamW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9c5e
cmp dword [0x1319882c], ebp
jne 0x12db9c50
cmp dword [0x13199e64], ebp
jne 0x12db9c50
mov ecx, 0x131bdd68
call fcn.12e98570
test eax, eax
je 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DispatchMessageA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e93
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DispatchMessageW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e93
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetClipboardData
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9cc8
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
jmp 0x12db9ec6
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetWindowTextW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9d30
mov ecx, 0x131bdd68
mov dword [esp + 0x1c], ebp
call fcn.12e98570
test eax, eax
jne 0x12db9eb1
push ebp
call fcn.12d91b20
add esp, 4
test eax, eax
jne 0x12db9eb1
lea ecx, [esp + 0x1c]
push ecx
call fcn.12f37900
add esp, 4
test eax, eax
je 0x12db9d26
cmp dword [esp + 0x1c], ebx
je 0x12db9eb1
call fcn.12d92ef0
jmp 0x12db9ead
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DestroyWindow
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9d98
mov ecx, 0x131bdd68
mov dword [esp + 0x1c], ebp
call fcn.12e98570
test eax, eax
jne 0x12db9d8a
mov ecx, 0x131c4d08
call fcn.12f1ad50
test eax, eax
jne 0x12db9d8a
lea edx, [esp + 0x1c]
push edx
call fcn.12f37900
add esp, 4
test eax, eax
je 0x12db9ec6
cmp dword [esp + 0x1c], ebx
jne 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.EmptyClipboard
call fcn.12f5ed10
add esp, 8
test eax, eax
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
jne 0x12db9dcd
mov ecx, 0x131b63a8
call fcn.12e57fc0
jmp 0x12db9ead
push str.EnumWindows
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9de9
cmp dword [0x13199e60], ebp
jmp 0x12db9eaf
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateWindowExA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e8b
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateWindowExW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e8b
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDialogIndirectParamA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e8b
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateWindowInBandEx
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9e8b
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetWindow
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9ec6
cmp dword [0x13199e64], ebp
jmp 0x12db9eaf
call fcn.12d91a00
test eax, eax
jne 0x12db9ebd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
push ecx
call fcn.12f37900
add esp, 4
test eax, eax
je 0x12db9ec6
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.user32.dll
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SwitchDesktop
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9f1c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetThreadDesktop
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9f45
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12db9f3b
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
jne 0x12db9f45
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SendMessageTimeoutW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9fb4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DdeConnect
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9fb4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DdeConnectList
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12db9fb4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.DdeDisconnect
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12db9fe3
cmp dword [esp + 0x70], ebp
je 0x12db9fe3
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12db9fd9
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
jne 0x12db9fe3
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov ecx, 0x131b5400
call fcn.12e3e140
test eax, eax
je 0x12dba06a
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.PeekMessageW
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba060
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.GetKeyState
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba060
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.EmptyClipboard
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba060
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetClipboardData
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba06a
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetClipboardData
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba0c1
call fcn.12e87a00
cmp dword [0x131bcbec], ebp
je 0x12dba09d
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12d92ea0
test eax, eax
je 0x12dba0c1
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
je 0x12dba0c1
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.TrackPopupmenu
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba0ef
call fcn.12d92f10
test eax, eax
je 0x12dba0ef
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d92de0
test eax, eax
je 0x12dba11d
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.IsClipboardFormatAvailable
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba11d
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LoadStringA
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba154
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.LoadStringW
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12f9c790
test eax, eax
je 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12e75b40
test eax, eax
je 0x12dba215
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3880
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba215
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3870
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba215
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba215
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3764
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba215
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130cfd18
call fcn.12f5ed10
add esp, 8
test eax, eax
je 0x12dba215
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
call fcn.12e497d0
test eax, eax
je 0x12dba26c
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
lea ecx, [esp + 0x10]
push edx
call fcn.12f469f0
mov eax, dword [eax]
mov byte [esp + 0x254], 0x64
push eax
call fcn.12e49840
add esp, 4
lea ecx, [esp + 0x10]
test eax, eax
sete bl
mov byte [esp + 0x254], 0x5b
call fcn.12f472f0
test bl, bl
je 0x12dba26c
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130cfd18
call fcn.12f5ed10
add esp, 8
test eax, eax
jne 0x12dba291
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [0x130d2abc]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x12db83ef
or edi, 0xffffffff
mov ecx, 0x1319a740
call fcn.12dc8720
call fcn.12ddb950
call fcn.12e9f3c0
call fcn.12d920a0
test eax, eax
jne 0x12dba2ea
push ebp
push 1
call fcn.12e8bc10
add esp, 8
test eax, eax
je 0x12dba2ea
call fcn.12e497d0
test eax, eax
jne 0x12dba2ea
push 1
call fcn.12e8aee0
add esp, 4
mov ecx, 0x131b7d00
call fcn.12e622a0
call fcn.12f05490
call fcn.12d920a0
test eax, eax
jne 0x12dba3cd
lea ecx, [esp + 0x4c]
xor esi, esi
call fcn.12e9bf00
push 1
push ebp
push ecx
mov bl, 0x65
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tmailhook_taccctrlstart
mov byte [esp + 0x264], bl
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12dba359
lea ecx, [esp + 0x4c]
call fcn.12e9c670
cmp eax, 1
je 0x12dba38a
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Safe_HostAddr_Redirection_To_SoftGateway
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12dba399
mov esi, 1
call fcn.12eb2ac0
mov dword [0x13199e58], eax
cmp dword [0x13199068], ebp
je 0x12dba3bc
mov ecx, dword [0x13199e58]
push ecx
push esi
push str.TAccCtrlStart___d___d_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c070
mov ecx, 0x131c4560
call fcn.12f11140
mov eax, dword [0x13199068]
xor edi, edi
cmp eax, ebp
je 0x12dba3f6
push str.DllProcAttach____5
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
push 1
mov ecx, 0x131c0930
call fcn.12ebfbe0
test eax, eax
jne 0x12dba418
mov ecx, 0x131c0930
call fcn.12ec0860
test eax, eax
je 0x12dba500
push 0xffffffffffffffff
mov ecx, 0x131c0930
call fcn.12ec0f10
push 0xffffffffffffffff
mov ecx, 0x131c0930
mov ebx, eax
call fcn.12ec0e90
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12dba453
push ebx
push esi
push str.DllProcAttach____6__SCDTProcType_d___Identify_08x_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12dba46b
cmp esi, 4
je 0x12dba46b
cmp esi, 5
je 0x12dba46b
test bl, 0x92
je 0x12dba4f1
push 0xffffffffffffffff
mov ecx, 0x131c0930
call fcn.12ec0e90
push eax
call fcn.12ec0a30
add esp, 4
test eax, eax
je 0x12dba4e7
lea ecx, [esp + 0x10]
call fcn.12eaaaa0
mov edx, dword [0x13196dc4]
lea eax, [esp + 0x70]
push 1
mov byte [esp + 0x258], 0x68
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x78], edx
call fcn.12eabc40
mov eax, dword [0x13199068]
mov edi, 1
cmp eax, ebp
je 0x12dba4d6
mov ecx, dword [esp + 0x70]
push ecx
push str.CTSCDTGlobalMgr::StartSandbox_add_WorkspaceAddProc__PID_d_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x254], 0x5b
call fcn.12eaaad0
mov ecx, 0x131c0930
call fcn.12ec2120
push ebp
mov ecx, 0x131c0930
call fcn.12ec1b00
cmp edi, ebp
jne 0x12dba579
push 0xffffffffffffffff
mov ecx, 0x131c0930
call fcn.12ec0f10
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12dba52c
push esi
push str.CTSCDTGlobalMgr::StartSandbox____7__identify_08x_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test esi, 0x20000000
je 0x12dba579
lea ecx, [esp + 0xb0]
call fcn.12eaaaa0
mov edx, dword [0x13196dc4]
lea eax, [esp + 0x10]
push 1
mov byte [esp + 0x258], 0x69
push eax
lea ecx, [esp + 0xb8]
mov dword [esp + 0x18], edx
call fcn.12eabc40
lea ecx, [esp + 0xb0]
mov byte [esp + 0x254], 0x5b
call fcn.12eaaad0
push 0x20000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12dba5a9
push 0x8000
call fcn.12e6efd0
add esp, 4
test eax, eax
jne 0x12dba5a9
push 5
call fcn.12e6f220
add esp, 4
test eax, eax
jne 0x12dba5df
call fcn.12d91c00
test eax, eax
jne 0x12dba5ba
cmp dword [0x13199a0c], ebp
je 0x12dba5c3
call fcn.12d91c20
test eax, eax
je 0x12dba5c8
call fcn.12f2b6e0
call fcn.12d920a0
test eax, eax
jne 0x12dba5df
call fcn.12d91c00
test eax, eax
jne 0x12dba5df
call fcn.12f2b8a0
mov ecx, 0x131c7ff0
call fcn.12f36c20
test eax, eax
je 0x12dba5f7
mov ecx, 0x131c7ed0
call fcn.12f2a0c0
push 0xffffffffffffffff
mov ecx, 0x131c0930
call fcn.12ec0e90
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12dba639
push esi
mov ecx, 0x131c0930
call fcn.12ec0930
push eax
call fcn.12d920a0
neg eax
sbb eax, eax
inc eax
push eax
push str.CTMailHookMgr::RegisterNetSecurityProc_0__d___d___d_
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
call fcn.12d920a0
test eax, eax
jne 0x12dba6eb
call fcn.12d91c00
test eax, eax
jne 0x12dba6eb
mov ebx, 1
cmp esi, ebx
je 0x12dba674
cmp esi, 4
je 0x12dba674
cmp esi, 5
je 0x12dba674
mov ecx, 0x131c0930
call fcn.12ec0930
test eax, eax
je 0x12dba6eb
call fcn.12eb2c30
mov edi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12dba699
push edi
push str.CTMailHookMgr::RegisterNetSecurityProc_1__d_
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp edi, ebp
je 0x12dba6eb
cmp esi, ebx
mov dword [0x131c0f90], ebx
je 0x12dba6b1
cmp esi, 4
je 0x12dba6b1
cmp esi, 5
jne 0x12dba6b7
mov dword [0x131c0f94], ebx
mov ecx, 0x131c0930
call fcn.12ecd820
push 0x12ed6c40
call fcn.12eb2c50
mov eax, dword [0x13199068]
add esp, 4
cmp eax, ebp
je 0x12dba6eb
push str.CTMailHookMgr::RegisterNetSecurityProc_2
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov esi, 1
mov dword [0x131999b0], esi
call fcn.12db3740
call fcn.12db37f0
mov ecx, 0x131be630
call fcn.12e9e4c0
mov ecx, 0x131aa308
call fcn.12e1da00
push ebp
call fcn.12e62c70
mov ecx, eax
call fcn.12e62d50
mov ecx, 0x131bdd68
call fcn.12e985c0
mov ecx, 0x131bcbd0
call fcn.12e87840
mov ecx, 0x13190f80
call fcn.12d81620
mov ecx, 0x131bd0f0
call fcn.12e8f950
mov ecx, 0x131bdca0
call fcn.12e965c0
mov ecx, 0x131b8078
call fcn.12e6c410
mov ecx, 0x131be5f8
call fcn.12e9d810
mov ecx, 0x131c3998
call fcn.12ef23e0
lea ecx, [esp + 0xd4]
call fcn.12e9bf00
push esi
push ebp
push ecx
mov bl, 0x6a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_udisk_encrypt_mode
mov byte [esp + 0x264], bl
call fcn.12f46b50
lea ecx, [esp + 0xe0]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0xd4]
call fcn.12e9c180
test eax, eax
je 0x12dba7e1
lea ecx, [esp + 0xd4]
call fcn.12e9c670
cmp eax, esi
je 0x12dba7dc
cmp eax, 2
je 0x12dba7dc
cmp eax, 3
mov dword [0x131a9050], ebp
jne 0x12dba7e1
mov dword [0x131a9050], eax
push esi
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_udisk_encrypt_ignore_type
call fcn.12f46b50
lea ecx, [esp + 0xe0]
mov byte [esp + 0x260], bl
call fcn.12e9c110
lea ecx, [esp + 0xd4]
call fcn.12e9c180
test eax, eax
je 0x12dba83a
lea ecx, [esp + 0xd4]
call fcn.12e9c670
cmp eax, esi
jne 0x12dba82f
mov dword [0x131a9054], esi
jmp 0x12dba83a
cmp eax, 2
jne 0x12dba83a
mov dword [0x131a9054], ebp
cmp dword [0x13199068], ebp
je 0x12dba864
mov ecx, dword [0x131a9054]
mov edx, dword [0x131a9050]
push ecx
push edx
push 0x130d3b6c
push str.udisk
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov esi, dword [esp + 0x78]
cmp esi, ebp
je 0x12dba87c
mov ecx, esi
call fcn.12ebae10
push esi
call fcn.12f5c050
add esp, 4
lea ecx, [esp + 0x7c]
call fcn.12daa2c0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x254], 0x6d
call fcn.12daa3c0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x254], bl
call fcn.12daa2f0
lea ecx, [esp + 0xd4]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c070
lea ecx, [esp + 0x130]
mov byte [esp + 0x254], 0x70
call fcn.12f472f0
lea ecx, [esp + 0x12c]
mov byte [esp + 0x254], 0x6f
call fcn.12f472f0
mov esi, dword [esp + 0x11c]
mov byte [esp + 0x254], 0x6e
cmp esi, ebp
je 0x12dba967
mov eax, dword [esp + 0x120]
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x12dba95c
lea ebp, [eax]
mov byte [esp + 0x254], 0x72
mov edi, dword [esi + 0x14]
test edi, edi
je 0x12dba93b
mov eax, dword [esi + 0x18]
mov ecx, eax
dec eax
test ecx, ecx
je 0x12dba92f
lea ebx, [eax + 1]
mov ecx, edi
call fcn.12dbace0
add edi, 0x14
dec ebx
jne 0x12dba922
mov eax, dword [esi + 0x14]
push eax
call fcn.12f5c050
add esp, 4
lea ecx, [esi + 4]
mov byte [esp + 0x254], 0x6e
call fcn.12f4cc80
add esi, 0x24
dec ebp
mov dword [esp + 0x10], esi
jne 0x12dba906
mov esi, dword [esp + 0x11c]
push esi
call fcn.12f5c050
add esp, 4
xor ebp, ebp
mov esi, dword [esp + 0x10c]
mov byte [esp + 0x254], 0x74
cmp esi, ebp
je 0x12dba9c5
mov eax, dword [esp + 0x110]
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x12dba9bc
lea edi, [eax]
mov bl, 0x76
lea ecx, [esi + 4]
mov byte [esp + 0x254], bl
call fcn.12f4cc80
mov ecx, esi
mov byte [esp + 0x254], 0x74
call fcn.12f472f0
add esi, 0x14
dec edi
mov dword [esp + 0x10], esi
jne 0x12dba98d
mov esi, dword [esp + 0x10c]
push esi
call fcn.12f5c050
add esp, 4
lea ecx, [esp + 0xfc]
mov byte [esp + 0x254], 0x5a
call fcn.12f4cc80
lea ecx, [esp + 0xc8]
mov dword [esp + 0x254], 0xffffffff
call fcn.12dac690
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x248
ret