Function at 0x100161a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004301f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x88
mov dword [ebp - 0x10], edi
call fcn.10024bba
push 0x88
mov esi, eax
push 0
push esi
call fcn.100268f0
add esp, 0x10
mov ecx, esi
call fcn.100157a0
mov dword [edi], eax
push 0xe8
mov dword [ebp - 4], 0
call fcn.10024bba
push 0xe8
mov esi, eax
push 0
push esi
call fcn.100268f0
add esp, 0x10
mov ecx, esi
call fcn.10015840
mov dword [edi + 4], eax
push 0x58
mov byte [ebp - 4], 1
call fcn.10024bba
xorps xmm0, xmm0
movq qword [eax + 0x14], xmm0
movq qword [eax + 0x2c], xmm0
movq qword [eax + 0x44], xmm0
movq qword [eax + 0x50], xmm0
mov dword [eax], vtable.Rd.0
movups xmmword [eax + 4], xmm0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0xf
mov byte [eax + 4], 0
movups xmmword [eax + 0x1c], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
movups xmmword [eax + 0x34], xmm0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0xf
mov byte [eax + 0x34], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [edi + 8], eax
push 0xc4
mov byte [ebp - 4], 2
call fcn.10024bba
push 0xc4
mov esi, eax
push 0
push esi
call fcn.100268f0
add esp, 0x14
mov ecx, esi
call fcn.10016a80
mov dword [edi + 0xc], eax
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xf
mov byte [edi + 0x10], 0
movups xmmword [edi + 0x28], xmm0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xf
mov byte [edi + 0x28], 0
movups xmmword [edi + 0x40], xmm0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0xf
mov byte [edi + 0x40], 0
mov esi, dword [ebp + 8]
mov edx, esi
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x14]
cmp eax, 0xf
jbe 0x10016316
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
cmp ecx, 0xd
jne 0x1001644e
mov eax, ecx
mov edi, str.RemoteDesktop
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016348
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001634d
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016331
cmp eax, 0xfffffffc
je 0x10016384
mov al, byte [edx]
cmp al, byte [edi]
jne 0x1001637d
cmp dword [ebp + 8], 0xfffffffd
je 0x10016384
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x1001637d
cmp dword [ebp + 8], 0xfffffffe
je 0x10016384
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x1001637d
cmp dword [ebp + 8], 0xffffffff
je 0x10016384
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016384
sbb eax, eax
or eax, 1
jmp 0x10016386
xor eax, eax
test eax, eax
jne 0x1001644b
push 0x58
call fcn.10024bba
mov edi, dword [ebp - 0x10]
xorps xmm0, xmm0
add esp, 4
movq qword [eax + 0x14], xmm0
movq qword [eax + 0x2c], xmm0
movq qword [eax + 0x44], xmm0
movq qword [eax + 0x50], xmm0
mov dword [eax], vtable.Rd.0
movups xmmword [eax + 4], xmm0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0xf
mov byte [eax + 4], 0
movups xmmword [eax + 0x1c], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
movups xmmword [eax + 0x34], xmm0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0xf
mov byte [eax + 0x34], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov ecx, dword [edi + 8]
mov dword [ebp + 8], ecx
mov dword [edi + 8], eax
test ecx, ecx
je 0x1001642e
call fcn.100095e0
push 0x58
push dword [ebp + 8]
call fcn.10024bea
add esp, 8
push esi
lea ecx, [edi + 0x10]
call fcn.100089f0
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x10016457
mov edx, dword [esi]
cmp ecx, 0xe
jne 0x10016510
mov eax, ecx
mov edi, str.SocketDownload
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016487
nop
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001648c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016470
cmp eax, 0xfffffffc
je 0x100164c3
mov al, byte [edx]
cmp al, byte [edi]
jne 0x100164bc
cmp dword [ebp + 8], 0xfffffffd
je 0x100164c3
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x100164bc
cmp dword [ebp + 8], 0xfffffffe
je 0x100164c3
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x100164bc
cmp dword [ebp + 8], 0xffffffff
je 0x100164c3
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x100164c3
sbb eax, eax
or eax, 1
jmp 0x100164c5
xor eax, eax
test eax, eax
jne 0x1001650d
push 0x88
call fcn.10024bba
push 0x88
mov edi, eax
push 0
push edi
call fcn.100268f0
add esp, 0x10
mov ecx, edi
call fcn.100157a0
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi]
mov dword [ebp + 8], ecx
mov dword [edi], eax
test ecx, ecx
je 0x10016695
call fcn.10009a10
push 0x88
jmp 0x1001668a
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x10016519
mov edx, dword [esi]
cmp ecx, 0xb
jne 0x100165d3
mov eax, ecx
mov edi, str.FileManager
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016548
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001654d
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016531
cmp eax, 0xfffffffc
je 0x10016584
mov al, byte [edx]
cmp al, byte [edi]
jne 0x1001657d
cmp dword [ebp + 8], 0xfffffffd
je 0x10016584
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x1001657d
cmp dword [ebp + 8], 0xfffffffe
je 0x10016584
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x1001657d
cmp dword [ebp + 8], 0xffffffff
je 0x10016584
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016584
sbb eax, eax
or eax, 1
jmp 0x10016586
xor eax, eax
test eax, eax
jne 0x100165d0
push 0xe8
call fcn.10024bba
push 0xe8
mov edi, eax
push 0
push edi
call fcn.100268f0
add esp, 0x10
mov ecx, edi
call fcn.10015840
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 4]
mov dword [ebp + 8], ecx
mov dword [edi + 4], eax
test ecx, ecx
je 0x10016695
call fcn.10009700
push 0xe8
jmp 0x1001668a
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x100165dc
mov edx, dword [esi]
cmp ecx, 0xa
jne 0x100166b5
mov eax, ecx
mov edi, 0x1004e770
sub eax, 4
mov dword [ebp + 8], eax
jb 0x1001660b
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10016610
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x100165f4
cmp eax, 0xfffffffc
je 0x10016647
mov al, byte [edx]
cmp al, byte [edi]
jne 0x10016640
cmp dword [ebp + 8], 0xfffffffd
je 0x10016647
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x10016640
cmp dword [ebp + 8], 0xfffffffe
je 0x10016647
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x10016640
cmp dword [ebp + 8], 0xffffffff
je 0x10016647
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016647
sbb eax, eax
or eax, 1
jmp 0x10016649
xor eax, eax
test eax, eax
jne 0x100166b2
push 0xc4
call fcn.10024bba
push 0xc4
mov edi, eax
push 0
push edi
call fcn.100268f0
add esp, 0x10
mov ecx, edi
call fcn.10016a80
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0xc]
mov dword [ebp + 8], ecx
mov dword [edi + 0xc], eax
test ecx, ecx
je 0x10016695
call fcn.10009380
push 0xc4
push dword [ebp + 8]
call fcn.10024bea
add esp, 8
push esi
lea ecx, [edi + 0x10]
call fcn.100089f0
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x100166be
mov edx, dword [esi]
cmp ecx, 4
jne 0x10016750
mov eax, ecx
mov edi, str.Ping
sub eax, ecx
mov dword [ebp + 8], eax
jb 0x100166ec
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x100166f1
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x100166d5
cmp eax, 0xfffffffc
je 0x10016728
mov al, byte [edx]
cmp al, byte [edi]
jne 0x10016721
cmp dword [ebp + 8], 0xfffffffd
je 0x10016728
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x10016721
cmp dword [ebp + 8], 0xfffffffe
je 0x10016728
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x10016721
cmp dword [ebp + 8], 0xffffffff
je 0x10016728
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016728
sbb eax, eax
or eax, 1
jmp 0x1001672a
xor eax, eax
test eax, eax
jne 0x1001674d
mov edi, dword [ebp - 0x10]
lea edx, [edi + 0x10]
cmp edx, esi
je 0x10016a5f
cmp dword [esi + 0x14], 0xf
jbe 0x10016744
mov esi, dword [esi]
push ecx
push esi
mov ecx, edx
jmp 0x10016a5a
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x10016759
mov edx, dword [esi]
cmp ecx, 4
jne 0x100167d0
mov eax, ecx
mov edi, str.Pong
sub eax, ecx
mov dword [ebp + 8], eax
jb 0x10016787
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001678c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016770
cmp eax, 0xfffffffc
je 0x100167c3
mov al, byte [edx]
cmp al, byte [edi]
jne 0x100167bc
cmp dword [ebp + 8], 0xfffffffd
je 0x100167c3
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x100167bc
cmp dword [ebp + 8], 0xfffffffe
je 0x100167c3
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x100167bc
cmp dword [ebp + 8], 0xffffffff
je 0x100167c3
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x100167c3
sbb eax, eax
or eax, 1
jmp 0x100167c5
xor eax, eax
test eax, eax
je 0x1001672e
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x100167d9
mov edx, dword [esi]
cmp ecx, 4
jne 0x10016850
mov eax, ecx
mov edi, str.Kill
sub eax, ecx
mov dword [ebp + 8], eax
jb 0x10016807
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001680c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x100167f0
cmp eax, 0xfffffffc
je 0x10016843
mov al, byte [edx]
cmp al, byte [edi]
jne 0x1001683c
cmp dword [ebp + 8], 0xfffffffd
je 0x10016843
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x1001683c
cmp dword [ebp + 8], 0xfffffffe
je 0x10016843
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x1001683c
cmp dword [ebp + 8], 0xffffffff
je 0x10016843
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016843
sbb eax, eax
or eax, 1
jmp 0x10016845
xor eax, eax
test eax, eax
je 0x1001672e
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x10016859
mov edx, dword [esi]
cmp ecx, 0xa
jne 0x100168d0
mov eax, ecx
mov edi, str.Disconnect
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016887
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001688c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016870
cmp eax, 0xfffffffc
je 0x100168c3
mov al, byte [edx]
cmp al, byte [edi]
jne 0x100168bc
cmp dword [ebp + 8], 0xfffffffd
je 0x100168c3
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x100168bc
cmp dword [ebp + 8], 0xfffffffe
je 0x100168c3
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x100168bc
cmp dword [ebp + 8], 0xffffffff
je 0x100168c3
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x100168c3
sbb eax, eax
or eax, 1
jmp 0x100168c5
xor eax, eax
test eax, eax
je 0x1001672e
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x100168d9
mov edx, dword [esi]
cmp ecx, 8
jne 0x10016950
mov eax, ecx
mov edi, str.Received
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016907
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001690c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x100168f0
cmp eax, 0xfffffffc
je 0x10016943
mov al, byte [edx]
cmp al, byte [edi]
jne 0x1001693c
cmp dword [ebp + 8], 0xfffffffd
je 0x10016943
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x1001693c
cmp dword [ebp + 8], 0xfffffffe
je 0x10016943
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x1001693c
cmp dword [ebp + 8], 0xffffffff
je 0x10016943
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016943
sbb eax, eax
or eax, 1
jmp 0x10016945
xor eax, eax
test eax, eax
je 0x1001672e
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x10016959
mov edx, dword [esi]
cmp ecx, 5
jne 0x100169d0
mov eax, ecx
mov edi, str.Error
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016987
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x1001698c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x10016970
cmp eax, 0xfffffffc
je 0x100169c3
mov al, byte [edx]
cmp al, byte [edi]
jne 0x100169bc
cmp dword [ebp + 8], 0xfffffffd
je 0x100169c3
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x100169bc
cmp dword [ebp + 8], 0xfffffffe
je 0x100169c3
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x100169bc
cmp dword [ebp + 8], 0xffffffff
je 0x100169c3
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x100169c3
sbb eax, eax
or eax, 1
jmp 0x100169c5
xor eax, eax
test eax, eax
je 0x1001672e
mov eax, dword [esi + 0x14]
mov edx, esi
cmp eax, 0xf
jbe 0x100169d9
mov edx, dword [esi]
cmp ecx, 0x26
jne 0x10016a4d
mov eax, ecx
mov edi, str.028B0274_0D13_4543_8D6A_1A53EB7F3723
sub eax, 4
mov dword [ebp + 8], eax
jb 0x10016a07
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10016a0c
mov eax, dword [ebp + 8]
add edx, 4
add edi, 4
sub eax, 4
mov dword [ebp + 8], eax
jae 0x100169f0
cmp eax, 0xfffffffc
je 0x10016a43
mov al, byte [edx]
cmp al, byte [edi]
jne 0x10016a3c
cmp dword [ebp + 8], 0xfffffffd
je 0x10016a43
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x10016a3c
cmp dword [ebp + 8], 0xfffffffe
je 0x10016a43
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x10016a3c
cmp dword [ebp + 8], 0xffffffff
je 0x10016a43
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x10016a43
sbb eax, eax
or eax, 1
jmp 0x10016a45
xor eax, eax
test eax, eax
je 0x1001672e
mov edi, dword [ebp - 0x10]
push 0
push 0x1004e0a4
lea ecx, [edi + 0x10]
call fcn.10008e10
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4