Function at 0x12db6500
Capabilities:
Accept command line arguments
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13058204
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x1319990c], ebp
call fcn.12f9c620
test eax, eax
mov edi, 1
je 0x12db6544
call fcn.12e30170
test eax, eax
jne 0x12db6544
mov dword [0x1319990c], edi
mov eax, dword [0x13198f68]
or ebx, 0xffffffff
cmp eax, ebp
je 0x12db6577
mov eax, dword [0x1319990c]
cmp eax, ebp
mov eax, 0x130d5030
jne 0x12db6563
mov eax, 0x130d5024
push eax
push str.Dll_Attach__Vista_Session0____s_
push 0x130c6b6c
push ebx
call fcn.12dad750
add esp, 0x10
push 0x130ccfe0
push str.Hookapi
mov ecx, 0x13198ed8
call fcn.12dad2e0
push ebp
push str.OAGENT3
call fcn.12f94a60
lea eax, [esp + 0x140]
push eax
call fcn.12e31de0
mov ecx, dword [0x13198f68]
add esp, 0xc
cmp ecx, ebp
je 0x12db65c4
push eax
push str.DllProcAttach__bGet_:__d_
push str.docrule
push ebx
call fcn.12dad750
add esp, 0x10
call fcn.12e32320
call fcn.12e36a60
call fcn.12e9a4d0
call fcn.12f9c4e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x25c]
push eax
push ecx
call fcn.12d8ec40
add esp, 8
call fcn.12d921a0
cmp dword [0x13198f68], ebp
je 0x12db6616
mov edx, dword [0x13196ccc]
push edx
push str.DllProcAttach__appname_:__s_
push str.AppName
push ebx
call fcn.12dad750
add esp, 0x10
mov dword [esp + 0x78], ebp
call fcn.12ebf8a0
test eax, eax
je 0x12db6652
push 4
call fcn.12f5bf8b
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebp
mov dword [esp + 0x254], ebp
je 0x12db6645
mov ecx, eax
call fcn.12ebade0
jmp 0x12db6647
xor eax, eax
mov dword [esp + 0x254], ebx
mov dword [esp + 0x78], eax
call fcn.12db2520
mov edx, dword [0x13198f68]
mov ecx, dword [0x13196ccc]
mov eax, dword [0x13196cd0]
cmp edx, ebp
mov dword [esp + 0x48], ecx
je 0x12db6697
cmp eax, ebp
jne 0x12db6679
mov eax, 0x130c8c0c
cmp ecx, ebp
jne 0x12db6682
mov ecx, 0x130c8c0c
push eax
push ecx
push str.Dll_Attach__name:__s___path:__s_
push 0x130c6b6c
push ebx
call fcn.12dad750
add esp, 0x14
push ebp
call fcn.12f29050
add esp, 4
call fcn.12f26740
call fcn.12d8a0c0
mov ecx, 0x131b62a8
call fcn.12e57f20
call fcn.12e6f0b0
push ebp
call sym.winahdcore32.dll_InitRecordMgr
push ebp
call sym.winahdcore32.dll_InitShareInfoMgr
push ebp
call fcn.12edb1e0
push 0x20000
call fcn.12e6efc0
add esp, 8
test eax, eax
je 0x12db66e6
mov ecx, 0x131c0830
call fcn.12ec9320
push ebp
mov ecx, 0x131c0830
call fcn.12ebfbd0
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
je 0x12db6752
mov ecx, 0x131c0830
call fcn.12ecaa40
mov ecx, 0x131c0830
call fcn.12ec4b90
mov ecx, 0x131c0830
call fcn.12ec8140
mov ecx, 0x131c0830
call fcn.12ec83d0
mov ecx, 0x131c0830
call fcn.12ec8af0
mov ecx, 0x131c0830
call fcn.12ec0c60
mov ecx, 0x131c0830
call fcn.12ec0d70
mov ecx, 0x131c0830
call fcn.12ec4fd0
push ebp
call fcn.12ec2600
add esp, 4
cmp eax, edi
mov dword [esp + 0x70], ebp
jne 0x12db6767
mov dword [esp + 0x70], edi
push 0x20000
xor esi, esi
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12db679a
push edi
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
je 0x12db681f
call fcn.12d91c00
test eax, eax
jne 0x12db681f
call fcn.12e75100
mov esi, eax
mov eax, dword [0x1319990c]
cmp eax, ebp
je 0x12db67b7
push ebp
mov ecx, 0x13196c48
call fcn.12d8d920
mov esi, eax
mov ecx, 0x131c0830
call fcn.12ec4030
mov ecx, 0x131c08d8
call fcn.12ee6370
push esi
mov ecx, 0x131c08d8
call fcn.12ee6620
mov ecx, 0x131c08d8
call fcn.12ee6670
push esi
mov ecx, 0x131c0834
call fcn.12ee6620
mov ecx, 0x131c0834
call fcn.12ee6660
mov ecx, 0x131c12e0
call fcn.12ed3220
mov ecx, 0x131c12e0
call fcn.12ed7e80
mov ecx, 0x131c12e0
call fcn.12ed8220
mov ecx, 0x131c12e0
call fcn.12ed86c0
mov esi, edi
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
je 0x12db6856
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12db6856
push edi
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
je 0x12db6876
call fcn.12d91c00
test eax, eax
jne 0x12db6876
call fcn.12d91c00
test eax, eax
jne 0x12db6876
mov eax, dword [0x13196cd0]
mov ecx, dword [0x13196ccc]
push eax
push ecx
mov ecx, 0x131bf358
call fcn.12eb3b50
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
je 0x12db688c
cmp esi, ebp
je 0x12db6931
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push edi
push ebp
push ecx
mov dword [esp + 0x260], edi
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x130764dc
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 1
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12db6921
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 1
call fcn.12e9c5e0
cmp eax, ebp
jne 0x12db691b
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 1
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db6921
mov dword [0x1319a128], edi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], ebx
call fcn.12e9c060
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push edi
push ebp
push ecx
mov dword [esp + 0x260], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076494
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 5
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12db69d0
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 5
call fcn.12e9c5e0
cmp eax, ebp
jne 0x12db69c4
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 5
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db69d0
mov dword [0x13108c28], ebp
mov dword [0x1319a128], ebp
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], ebx
call fcn.12e9c060
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push edi
push ebp
push ecx
mov dword [esp + 0x260], 9
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076530
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 9
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c170
test eax, eax
je 0x12db6a7b
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 9
call fcn.12e9c5e0
cmp eax, ebp
jne 0x12db6a73
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 9
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db6a7b
mov dword [0x1319a12c], edi
jmp 0x12db6a87
cmp dword [0x1319a12c], ebp
je 0x12db6b2c
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push edi
push ebp
push ecx
mov bl, 0xd
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x13076594
mov byte [esp + 0x264], bl
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12db6b1b
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
cmp eax, ebp
jne 0x12db6b15
call fcn.12db2790
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db6b1b
mov dword [0x1319a12c], ebp
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 9
call fcn.12e9c060
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], 0xffffffff
call fcn.12e9c060
mov ecx, 0x82
xor eax, eax
mov edi, 0x1319992c
push 0x130d4ee8
rep stosd dword es:[edi], eax
call fcn.12d8c620
push eax
push 0x130c4e18
push 0x1319992c
call fcn.12f5ceef
add esp, 0x10
call fcn.12f9c450
test eax, eax
je 0x12db6b9f
mov ecx, 0x82
xor eax, eax
mov edi, 0x13199b34
push 0x130d4ec4
rep stosd dword es:[edi], eax
call fcn.12d8ba90
push eax
push 0x130c4e18
push 0x13199b34
call fcn.12f5ceef
add esp, 0x10
call fcn.12e5bcf0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
push 0x4ff
mov ecx, 0x131b5e30
push str.G:WorkshopAgentDevelopProjCodePreReleaseHOOKAPIPreReleaseDetoursProjectDetoursEntityNTDetoursEntityNT.cpp
push esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], 2
call fcn.12f567f0
mov edi, eax
mov dword [esp + 0xbc], edi
push 1
push ebp
push ecx
mov ebx, 0x11
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinj_external_crypt
mov dword [esp + 0x264], ebx
call fcn.12f46a80
mov ecx, 0x13199ea0
mov byte [esp + 0x260], bl
call fcn.12e9c100
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinj_external
call fcn.12f46a80
mov ecx, 0x13199e00
mov byte [esp + 0x260], bl
call fcn.12e9c100
cmp edi, ebp
mov dword [esp + 0x254], 0xffffffff
je 0x12db6c53
push esi
mov ecx, 0x131b5e30
call fcn.12f56a70
call fcn.12e4c230
call fcn.12d92050
mov dword [0x131998d8], eax
call fcn.12db6060
call fcn.12db60e0
mov ebx, 1
lea ecx, [esp + 0x20]
mov dword [0x130cf408], ebx
mov dword [0x130cf40c], ebx
mov dword [0x131998e0], ebp
call fcn.12e9bef0
push ebx
push ebp
push ecx
mov dword [esp + 0x260], 0x14
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_inj21_mode
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 0x14
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.12e9c170
test eax, eax
je 0x12db6cee
cmp esi, ebx
jne 0x12db6ce3
mov dword [0x130cf40c], ebp
jmp 0x12db6cee
cmp esi, 2
jne 0x12db6cee
mov dword [0x130cf408], ebp
call fcn.12f9d330
test eax, eax
je 0x12db6d62
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov bl, 0x16
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.injectdriver_safemode
mov byte [esp + 0x264], bl
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
cmp eax, ebp
je 0x12db6d48
cmp eax, 1
jne 0x12db6d4e
mov dword [0x130cf40c], ebp
lea ecx, [esp + 0x8c]
mov byte [esp + 0x254], 0x14
call fcn.12e9c060
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db6d8e
mov edx, dword [0x130cf408]
mov eax, dword [0x130cf40c]
push edx
push eax
push edi
push esi
push str.DllProcAttach_Inject21_Mode___d___08x____d__d_
push str.Inject
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov bl, 0x18
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.injectdriver_dis
mov byte [esp + 0x264], bl
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db6df6
mov ecx, dword [esp + 0x6c]
or edi, 0xffffffff
push ecx
push esi
push str.DllProcAttach_TIjtDrv__Config__1___d____08x_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x14
jmp 0x12db6df9
or edi, 0xffffffff
cmp esi, ebp
je 0x12db6e02
cmp esi, 1
jne 0x12db6e2f
mov eax, dword [0x13198f68]
mov dword [0x131998e0], 1
cmp eax, ebp
mov dword [0x130cf40c], ebp
je 0x12db6e2f
push ebp
push str.DllProcAttach_TIjtDrv__Config__2__________d_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x14
call fcn.12e9c060
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
call fcn.12e752c0
test al, 8
je 0x12db6e7e
cmp dword [0x13198f68], ebp
je 0x12db6e74
push str.DllProcAttach_Inject1.5
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0xc
mov dword [0x131998dc], 1
lea ecx, [esp + 0x20]
mov dword [0x131998e4], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x1a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hook_createprocessret_filter
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db6eea
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_CreaterPRetfilter__Config__1___d____08x_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db6ef3
mov eax, esi
jmp 0x12db6ef5
xor eax, eax
mov ecx, dword [0x13198f68]
mov dword [0x131998e4], eax
cmp ecx, ebp
je 0x12db6f18
push eax
push str.DllProcAttach_CreaterPRetfilter__Config__2__________d_
push str.Inject
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x1c
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tfw_enumfilter_proc
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12db6f95
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
mov dword [0x13199d60], eax
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tfw_createwndfilter_proc
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12db6fef
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
mov dword [0x13199d64], eax
jmp 0x12db704c
mov eax, dword [0x13196ccc]
lea ecx, [esp + 0x18]
push eax
call fcn.12f46a80
mov ecx, dword [esp + 0x18]
push str.alias.exe
push ecx
mov byte [esp + 0x25c], 0x21
call fcn.12f5e1d4
add esp, 8
cmp eax, ebp
je 0x12db7032
mov edx, dword [esp + 0x18]
push str.teamcenter.exe
push edx
call fcn.12f5e1d4
add esp, 8
cmp eax, ebp
jne 0x12db703c
mov dword [0x13199d64], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], bl
call fcn.12f47220
cmp dword [0x13198f68], ebp
je 0x12db7074
mov eax, dword [0x13199d60]
mov ecx, dword [0x13199d64]
push eax
push ecx
push str.DllProcAttach__TFWCreateWndFilter:__d___TFWEnumFilter:__d_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
cmp dword [0x130cf41c], ebp
je 0x12db70a2
call fcn.12f9c450
test eax, eax
jne 0x12db70a2
push str.tsysdrv.dll
call fcn.12ff8910
add esp, 4
push str.FindNextFileW
push str.Kernel32.dll
call fcn.12f29580
push str.ShellExecuteExW
push str.Shell32.dll
mov dword [0x1319a120], eax
call fcn.12f29580
add esp, 0x10
mov dword [0x1319a124], eax
call fcn.12d91c00
test eax, eax
jne 0x12db70ea
mov edx, dword [0x13196ccc]
push edx
call fcn.12e0f5e0
add esp, 4
call fcn.12e0f710
call fcn.12d91a00
test eax, eax
jne 0x12db70fc
call fcn.12d91c60
test eax, eax
je 0x12db7111
push 1
call fcn.12e0aae0
mov eax, dword [0x13196ccc]
push eax
call fcn.12e0aaf0
add esp, 8
call fcn.12d91c80
test eax, eax
je 0x12db7130
push 1
call fcn.12e0aba0
mov ecx, dword [0x13196ccc]
push ecx
call fcn.12e0abb0
add esp, 8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x149]
mov byte [esp + 0x148], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x148]
push 0x104
stosb byte es:[edi], al
mov eax, dword [0x13196cd0]
push edx
push 0xffffffffffffffff
push eax
call fcn.12e2f7e0
mov edx, dword [0x13196cc4]
add esp, 0x10
lea ecx, [esp + 0x148]
push ecx
push edx
mov ecx, 0x131b7e0c
call fcn.12e63bb0
lea eax, [esp + 0x148]
mov ecx, 0x131b7e0c
push eax
call fcn.12e63e00
test eax, eax
je 0x12db71a9
lea ecx, [esp + 0x148]
push ecx
mov ecx, 0x131b7e0c
call fcn.12e63ea0
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12db7217
push str.adb.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12db7217
call fcn.12f292f0
mov ebx, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db71e8
push ebx
push str.DllProcAttach_1_Flags:_0x_08x
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test bl, 8
jne 0x12db7217
or ebx, 8
push ebx
call fcn.12f292d0
mov eax, dword [0x13198f68]
add esp, 4
cmp eax, ebp
je 0x12db7217
push ebx
push str.DllProcAttach_2_Flags:_0x_08x
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
call fcn.12d92b60
test eax, eax
je 0x12db7225
call fcn.12eaa870
mov edi, 1
mov dword [esp + 0x80], edi
call fcn.12d91a00
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x12db72f6
call fcn.12eaa870
call fcn.12da33b0
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
push edi
push ebp
push ecx
mov ebx, 0x22
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Disable_SaveAsFileCheck
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
cmp eax, edi
mov dword [0x130cf410], ebp
je 0x12db72a8
mov dword [0x130cf410], edi
or edi, 0xffffffff
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, edi
mov dword [0x130d0b50], eax
je 0x12db72d5
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call esi
cmp eax, ebp
je 0x12db72f9
push str._SEPARATE
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12db72f9
mov dword [esp + 0x80], ebp
jmp 0x12db72f9
or edi, 0xffffffff
call esi
cmp eax, ebp
je 0x12db731b
push str.__channel
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12db731b
mov dword [0x1319991c], 1
call fcn.12e394d0
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov dword [esp + 0x260], 0x24
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_dis
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x24
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7386
mov edx, dword [esp + 0x6c]
push edx
push esi
push str.DllProcAttach_UpDown_Log_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db7396
mov dword [0x131998e8], esi
jmp 0x12db7489
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_filter
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x24
call fcn.12e9c100
mov eax, dword [0x1307d25c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov bl, 0x27
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5c0
cmp dword [0x13198f68], ebp
je 0x12db7400
mov edx, dword [esp + 0x18]
push esi
push edx
push str.DllProcAttach_UpDown_Log_Filter___s___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db7430
mov dword [0x131998e8], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], 0x24
call fcn.12f47220
cmp dword [0x131998e8], ebp
jne 0x12db7489
mov ebx, dword [0x13196ccc]
mov dword [esp + 0x1c], str.i4tools.exe
cmp ebx, ebp
je 0x12db7489
xor esi, esi
lea edi, [esp + 0x1c]
mov eax, dword [edi]
push ebx
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12db747c
inc esi
add edi, 4
cmp esi, 1
jl 0x12db7461
jmp 0x12db7486
mov dword [0x131998e8], 1
or edi, 0xffffffff
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x29
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_ctrl_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db74ff
mov ecx, dword [esp + 0x6c]
push ecx
push esi
push str.DllProcAttach_UpDown_Ctrl_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db750f
mov dword [0x131998ec], esi
jmp 0x12db75b9
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_ctrl_filter
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
mov edx, dword [0x1307d25c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x258], 0x2c
call fcn.12e9c5c0
cmp dword [0x13198f68], ebp
je 0x12db7578
mov ecx, dword [esp + 0x18]
push esi
push ecx
push str.DllProcAttach_UpDown_Ctrl_Filter___s___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 0x2c
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db75a9
mov dword [0x131998ec], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x254], bl
call fcn.12f47220
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
mov ecx, 0x131c7b28
call fcn.12f201c0
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x2e
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_dis_updown_options
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7639
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_UpDown_Ctrl_Dis___d___08x_
push str.UpDown
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
mov dword [0x130cf414], ebp
je 0x12db764e
mov dword [0x130cf414], 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
cmp dword [0x131998e8], ebp
jne 0x12db766b
call fcn.12f04e10
cmp dword [0x131998ec], ebp
jne 0x12db7678
call fcn.12f0d550
call fcn.12f0f010
mov ecx, 0x131b6090
call fcn.12e57ab0
mov ecx, 0x13197d08
call fcn.12d9d8a0
call fcn.12f031e0
lea ecx, [esp + 0x20]
mov dword [0x13199914], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x30
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.shelllog_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7702
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_ShellLog_Log_Dis___d___08x_
push str.ShellLog
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db770d
mov dword [0x131998f0], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x32
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ifo_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7783
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_IFO_Dis___d___08x_
push 0x130d487c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db778e
mov dword [0x131998f4], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x34
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_oeawatermask_disable
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7804
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach__OeaWM_dis___d___08x_
push str.PrintRule
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db780f
mov dword [0x13199910], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
mov dword [esp + 0x88], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x36
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_format_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db788c
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_Format_dis___d___08x_
push str.HookFormat
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db7898
mov dword [esp + 0x88], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x38
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_flushbuffer
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db790e
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_FlushBuffer___d___08x_
push str.DoEncrypt
push edi
call fcn.12dad750
add esp, 0x14
mov ebx, 1
cmp esi, ebx
je 0x12db7930
call fcn.12e754e0
cmp eax, 0x654d
je 0x12db7930
cmp esi, 2
jne 0x12db7936
mov dword [0x130cf418], ebp
jmp 0x12db7936
mov dword [0x130cf418], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
push ebx
push ebp
push ecx
mov dword [esp + 0x80], ebp
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterdll
call fcn.12f46a80
mov ecx, 0x13199f98
mov dword [esp + 0x260], edi
call fcn.12e9c100
mov eax, dword [0x13198f68]
mov esi, dword [0x13199fb8]
cmp eax, ebp
je 0x12db7994
push esi
push str.DllProcAttach_FilterDll__d
push str.FilterDll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
je 0x12db79a0
mov dword [esp + 0x74], ebx
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x3b
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.traceall
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
mov eax, dword [0x13198f68]
mov ecx, dword [esp + 0x40]
cmp eax, ebp
mov esi, ecx
je 0x12db79fc
push ecx
push str.DllProcAttach_TraceAll_01__08x
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
jne 0x12db7a7c
mov ecx, 0x131a8c60
call fcn.12e033c0
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7a2d
push esi
push str.DllProcAttach_TraceAll_02__d
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, ebp
jne 0x12db7a7c
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db7a7c
mov ecx, 0x131a8c60
call fcn.12e033b0
cmp dword [0x13198f68], ebp
je 0x12db7a7c
push str.DllProcAttach_TraceAll_03
push str.TraceAll
push edi
call fcn.12dad750
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
mov esi, 1
mov ebx, 0x3e
push esi
push ebp
push ecx
mov dword [esp + 0x260], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.doclog_dis
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
cmp eax, esi
jne 0x12db7ae5
mov dword [0x13199920], esi
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
push esi
push ebp
push ecx
mov dword [esp + 0x260], 0x40
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.upload_control_mode
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], 0x40
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
mov ecx, dword [0x13198f68]
mov dword [0x13199d48], eax
cmp ecx, ebp
je 0x12db7b65
push eax
push str.DllProcAttach_UploadControlMode:_d
push str.TUploadCtrl
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
push esi
push ebp
push ecx
mov ebx, 0x42
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.uploadfile_control
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
cmp eax, esi
jne 0x12db7bce
mov dword [0x130cf420], esi
jmp 0x12db7bdc
xor edx, edx
cmp eax, 2
setne dl
mov dword [0x130cf420], edx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
call fcn.12d91e40
test eax, eax
jne 0x12db7c01
call fcn.12d91fe0
test eax, eax
je 0x12db7c6e
lea ecx, [esp + 0x8c]
call fcn.12e9bef0
push esi
push ebp
push ecx
mov ebx, 0x44
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ie_uploadlog_record_apicom
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x98]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x8c]
call fcn.12e9c660
cmp eax, esi
mov dword [0x13199d4c], esi
je 0x12db7c5b
mov dword [0x13199d4c], ebp
lea ecx, [esp + 0x8c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
call fcn.12db2670
mov dword [0x131998f8], esi
call fcn.12d91a00
test eax, eax
je 0x12db7d0c
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x46
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_ext_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7cec
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_UDisk_Ctrl_Ext_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7cf7
mov dword [0x131998f8], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
mov esi, 1
cmp dword [0x13198f68], ebp
je 0x12db7d2e
mov ecx, dword [0x131998f8]
push ecx
push str.DllProcAttach_UDisk_Ctrl_Ext_Dis_2___d_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x10
mov dword [0x131998fc], esi
call fcn.12f9c620
test eax, eax
je 0x12db7dd4
call fcn.12f9c450
test eax, eax
je 0x12db7dd4
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x48
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_Getpathfromhandle_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7db4
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7dbf
mov dword [0x131998fc], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
mov esi, 1
call fcn.12e39c10
mov dword [0x13199900], esi
call fcn.12f9c620
test eax, eax
je 0x12db7e83
call fcn.12d91a00
test eax, eax
jne 0x12db7e02
call fcn.12d92b60
test eax, eax
je 0x12db7e83
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x4a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.udisk_ctrl_SHSimulate_dis
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7e68
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7e73
mov dword [0x13199900], ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
mov dword [0x13199904], ebp
call fcn.12d91a00
test eax, eax
je 0x12db7f52
lea ecx, [esp + 0x20]
xor esi, esi
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x4c
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UDiskRuleOutgo
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
mov eax, dword [esp + 0x40]
cmp eax, 0xf0000001
mov edi, eax
jne 0x12db7efb
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
cmp esi, 1
je 0x12db7f13
cmp esi, 2
jne 0x12db7efb
mov dword [0x13199904], ebp
jmp 0x12db7f1d
mov dword [0x13199904], ebp
call fcn.12e754e0
push eax
call fcn.12e64dd0
add esp, 4
test eax, eax
je 0x12db7f1d
mov dword [0x13199904], 1
cmp dword [0x13198f68], ebp
je 0x12db7f3b
push edi
push esi
push str.DllProcAttach_UDisk_Ctrl_lGetPathFormHandle_Dis_1___d___08x_
push str.UDisk
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], 0xffffffff
call fcn.12e9c060
or edi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x4e
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.updown_log_addudlog
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db7fb8
mov ecx, dword [esp + 0x40]
push ecx
push esi
push str.DllProcAttach_AddUDLog___d___08x_
push str.udlog
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12db7fd7
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12db7fe1
push str.sogouexplorer.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12db7fe1
mov dword [0x13199908], 1
cmp dword [0x13198f68], ebp
je 0x12db8003
mov edx, dword [0x13199908]
push edx
push str.DllProcAttach_AddUDLog__g_bAddUDLog:_d_
push str.udlog
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x50
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_passielog
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
mov eax, dword [0x13198f68]
mov ecx, dword [esp + 0x40]
cmp eax, ebp
mov esi, ecx
je 0x12db806f
push ecx
push str.DllProcAttach_PassIELog_1___lu_
push 0x130d43e8
push edi
call fcn.12dad750
add esp, 0x10
cmp esi, 0xf0000001
jne 0x12db80a3
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov ecx, dword [0x13198f68]
mov dword [0x13199928], eax
cmp ecx, ebp
je 0x12db80a3
push eax
push str.DllProcAttach_PassIELog_2___lu_
push 0x130d43e8
push edi
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x52
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.dishook_msi
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db811d
mov eax, dword [esp + 0x6c]
push eax
push esi
push str.DllProcAttach_DisHook_msi___d___08x_
push 0x130d4350
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db8128
mov dword [esp + 0x44], esi
jmp 0x12db815a
cmp esi, 2
je 0x12db8156
mov dword [esp + 0x44], 1
call fcn.12d91a00
test eax, eax
jne 0x12db8156
mov ecx, dword [0x13196ccc]
push str.SystemSettings.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12db815a
mov dword [esp + 0x44], ebp
mov edx, dword [0x13196ccc]
push str.java.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12db81b9
mov eax, dword [0x13196ccc]
push str.javaw.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12db81b9
mov ecx, dword [0x13196ccc]
push str.studio.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12db81b9
mov edx, dword [0x13196ccc]
push str.studio64.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12db81c1
mov dword [esp + 0x44], 1
mov ecx, dword [0x13196ccc]
lea eax, [esp + 0x44]
push eax
push ecx
call fcn.12db6280
mov eax, dword [esp + 0x4c]
add esp, 8
cmp eax, ebp
jne 0x12db822f
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_msi_filter
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], bl
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db822f
mov dword [esp + 0x44], 1
lea ecx, [esp + 0x4c]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
mov dword [0x13199d40], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x56
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_escape
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db82ab
mov edx, dword [esp + 0x40]
push edx
push esi
push str.DllProcAttach_hookescape___d___08x_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, 1
jne 0x12db82b6
mov dword [0x13199d40], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
lea ecx, [esp + 0x20]
mov dword [0x13199d44], ebp
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x58
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_watermark_xor_mode
mov dword [esp + 0x264], ebx
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x20]
call fcn.12e9c660
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db8332
mov eax, dword [esp + 0x40]
push eax
push esi
push str.DllProcAttach_WaterMark_Xor_Mode___d___08x_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
cmp esi, ebp
jbe 0x12db833c
mov dword [0x13199d44], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x254], edi
call fcn.12e9c060
mov ecx, 0x13198708
call fcn.12da1630
mov ecx, 0x131bcb08
call fcn.12e88200
mov ecx, dword [0x13196ccc]
push ecx
call fcn.12e11530
add esp, 4
call fcn.12e12170
call fcn.12eae000
mov ecx, 0x131a9098
call fcn.12e0adf0
push 1
push edi
mov ecx, 0x131bf008
call fcn.12eaf990
push 1
lea ecx, [esp + 0xcc]
call fcn.12dac640
lea ecx, [esp + 0xf8]
mov dword [esp + 0x254], 0x5a
call fcn.12e380e0
mov edx, dword [0x13196ccc]
lea ecx, [esp + 0xf8]
push edx
mov byte [esp + 0x258], 0x5b
call fcn.12e38e60
mov dword [esp + 0xc0], eax
mov eax, dword [0x130d2abc]
cmp eax, ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x18], ebp
jbe 0x12dba2ab
cmp dword [esp + 0xc0], ebp
je 0x12db84a1
mov esi, dword [esp + 0x18]
mov eax, dword [0x130d2ab8]
shl esi, 5
mov ecx, dword [esi + eax + 4]
push ecx
lea ecx, [esp + 0xb4]
call fcn.12f46920
mov edx, dword [0x130d2ab8]
mov edi, dword [eax]
lea ecx, [esp + 0xc4]
mov byte [esp + 0x254], 0x5c
mov eax, dword [esi + edx]
push eax
call fcn.12f46920
mov eax, dword [eax]
lea ecx, [esp + 0x84]
push ecx
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x260], 0x5d
call fcn.12e38bd0
lea ecx, [esp + 0xc4]
mov edi, eax
mov byte [esp + 0x254], 0x5c
call fcn.12f47220
lea ecx, [esp + 0xb0]
mov byte [esp + 0x254], 0x5b
call fcn.12f47220
cmp dword [esp + 0x84], ebp
je 0x12db84a1
mov eax, dword [0x130d2ab8]
xor edx, edx
cmp edi, ebp
sete dl
mov dword [esi + eax + 0x10], edx
jmp 0x12dba291
mov edi, dword [esp + 0x18]
mov ecx, dword [0x130d2ab8]
mov esi, edi
shl esi, 5
mov edx, dword [esi + ecx + 4]
lea ecx, [esp + 0xc8]
push edx
call fcn.12dac7f0
test eax, eax
jne 0x12db84d7
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
jmp 0x12dba291
cmp dword [esp + 0x44], ebp
je 0x12db8521
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.msi.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8521
cmp dword [0x13198f68], ebp
je 0x12db8514
push str.filter_msi.dll
push 0x130d4230
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
call fcn.12d92ed0
test eax, eax
je 0x12db858f
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d35c4
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db857c
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.FormatMessageA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db858f
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatMessageW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db858f
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], 3
jmp 0x12dba291
mov eax, dword [0x130d2ab8]
mov edx, dword [esi + eax + 0x18]
mov eax, dword [esi + eax + 4]
push edx
push eax
call fcn.12f268c0
mov ecx, dword [0x130d2ab8]
add esp, 8
mov dword [esi + ecx + 0x18], eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db85e1
mov eax, dword [0x130d2ab8]
mov edx, dword [esi + eax + 0x18]
mov ecx, dword [esi + eax + 4]
push edx
mov edx, dword [esi + eax]
push ecx
push edx
push edi
push str.DllProcAttach__i___d____S____S____08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
call fcn.12d91ba0
test eax, eax
je 0x12db85fa
mov eax, dword [0x130d2ab8]
mov ebx, 1
mov dword [esi + eax + 0x10], ebx
jmp 0x12db85ff
mov ebx, 1
call fcn.12d920a0
test eax, eax
je 0x12db8754
cmp dword [0x13198f68], ebp
je 0x12db8658
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 0x10]
mov edx, dword [esi + eax + 4]
mov eax, dword [esi + eax]
push ecx
push edx
push eax
push str.DllProcAttach___S____S____lu_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
mov eax, dword [0x13198f68]
add esp, 0x18
cmp eax, ebp
je 0x12db8658
push str.DllProcAttach_1
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
push 0x130d3870
mov dword [esi + ecx + 0x10], ebx
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db86ed
mov ecx, dword [0x130d2ab8]
push 0x130d3858
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db86ed
mov eax, dword [0x130d2ab8]
push 0x130d3880
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db86ed
mov edx, dword [0x130d2ab8]
push str.CreateProcessWithTokenW
mov eax, dword [esi + edx + 4]
push eax
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db86ed
mov ecx, dword [0x130d2ab8]
push 0x130cfd18
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db86f6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov ecx, dword [0x130d2ab8]
push 0x130d3880
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db872d
call fcn.12f9c550
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
push 0x130d3858
mov edx, dword [esi + ecx + 4]
push edx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12f9c510
jmp 0x12db8717
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d3a3c
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8852
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DragQueryFileA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8814
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.DragQueryFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8814
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ShellExecuteExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHAddToRecentDocs
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db87f8
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHOpenPropSheetW
call fcn.12f5ec40
add esp, 8
jmp 0x12dba170
call fcn.12d91a00
test eax, eax
jne 0x12db8837
call fcn.12f9c620
test eax, eax
jne 0x12db8837
mov edx, dword [esp + 0x48]
push edx
call fcn.12f101c0
add esp, 4
test eax, eax
jne 0x12db8840
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
call fcn.12d92ef0
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d3998
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db894b
call fcn.12d92070
test eax, eax
je 0x12db88a0
cmp dword [0x13198f68], ebp
je 0x12db8896
push str.DllProcAttach__IE10After_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
call fcn.12d92110
test eax, eax
jne 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetOpenFileNameA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8920
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.GetOpenFileNameW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8920
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.GetSaveFileNameA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8920
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetSaveFileNameW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
cmp dword [0x13198f68], ebp
je 0x12db893c
push str.DllProcAttach___IsGUIProgram_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.comctl32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db89d7
cmp dword [0x13198f68], ebp
je 0x12db8982
push str.DllProcAttach__IE10After_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
call fcn.12d92110
test eax, eax
jne 0x12db8995
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.PropertySheetW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db89bb
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
mov eax, dword [0x130d2ab8]
cmp dword [esi + eax + 0x10], ebp
jne 0x12dba170
mov dword [esi + eax + 0x10], 4
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d391c
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8e21
cmp dword [0x13198f68], ebp
je 0x12db8a12
push str.ntdll
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3900
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8a8e
call fcn.12f9c530
test eax, eax
je 0x12dba170
cmp dword [0x13198f68], ebp
je 0x12db8a57
push str.ntdll_1
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
call fcn.12d92080
test eax, eax
je 0x12dba170
cmp dword [0x13198f68], ebp
je 0x12db8a80
push str.ntdll_2
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d38cc
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8b86
call fcn.12d92390
test eax, eax
je 0x12db8ac0
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
push ebx
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
je 0x12db8ad9
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
lea ecx, [esp + 0x20]
call fcn.12e9bef0
push ebx
push ebp
push ecx
mov byte [esp + 0x260], 0x5e
mov ecx, esp
mov dword [esp + 0x28], esp
push str.hookapi_ntcreatefile_proc
call fcn.12f46a80
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 0x5e
call fcn.12e9c100
mov edi, dword [esp + 0x40]
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x258], 0x5e
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db8b49
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov dword [0x1319a134], ebx
cmp dword [0x13198f68], ebp
je 0x12db8b70
mov eax, dword [0x130d2ab8]
push edi
mov ecx, dword [esi + eax + 0x10]
push ecx
push str.DllProcAttach_NTCreateFile_Hook___d____08x_
push 0x130d407c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x20]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c060
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d38f4
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8cb6
call fcn.12f9c7b0
test eax, eax
je 0x12db8bc2
call fcn.12d91a60
test eax, eax
je 0x12db8bc2
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edi, dword [esp + 0x48]
push edi
push str.rm.exe
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12db8bea
push edi
push str.mv.exe
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12db8bf4
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
push ebx
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
je 0x12db8c0c
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
push ebx
push ebp
push ecx
mov byte [esp + 0x260], 0x61
mov ecx, esp
mov dword [esp + 0x28], esp
push str.hookapi_ntopenfile_proc
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], 0x61
call fcn.12e9c100
mov edi, dword [esp + 0x6c]
call fcn.12dbaa10
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x50]
mov byte [esp + 0x258], 0x61
call fcn.12e9c5e0
cmp eax, ebp
je 0x12db8c7c
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov dword [0x1319a130], ebx
cmp dword [0x13198f68], ebp
je 0x12db8ca0
mov edx, dword [0x1319a130]
push edi
push edx
push str.DllProcAttach_NTOpenFile_Hook___d____08x_
push str.docrule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c060
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.NtQueryDirectoryFile
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8cfc
call fcn.12d91a00
test eax, eax
je 0x12dba170
cmp dword [0x131a9314], ebp
jne 0x12db99fa
push 0x20000
call fcn.12e6efc0
add esp, 4
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LdrLoadDll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8d2e
call fcn.12d92340
test eax, eax
jne 0x12db99fa
call fcn.12d91f30
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.NtAlpcConnectPort
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8de6
call fcn.12d929c0
test eax, eax
je 0x12db8d62
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12db8d98
mov ecx, 0x131bf008
call fcn.12eaf8f0
test eax, eax
jne 0x12db8d8f
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12db8d8f
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
jne 0x12db8d98
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
cmp dword [0x13198f68], ebp
je 0x12dba170
push 5
call fcn.12e6f210
add esp, 4
neg eax
sbb eax, eax
inc eax
push eax
push 0x20000
call fcn.12e6efc0
add esp, 4
mov ecx, 0x131bf008
push eax
call fcn.12eaf8f0
push eax
push str.DllProcAttach_NtAlpcConnectPortnt___d__d__d_
push 0x130d4230
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3890
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92090
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130c55d4
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db93f1
mov eax, dword [0x130d2ab8]
push 0x130d3880
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8e66
call fcn.12f9c550
test eax, eax
je 0x12db8e94
jmp 0x12db8e8a
mov eax, dword [0x130d2ab8]
push 0x130d3858
mov ecx, dword [esi + eax + 4]
push ecx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8e94
call fcn.12f9c510
test eax, eax
je 0x12db8e94
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d91a00
test eax, eax
je 0x12db8ffb
cmp dword [esp + 0x80], ebp
je 0x12db8ffb
mov eax, dword [0x131998f8]
cmp eax, ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ReadFile
je 0x12db8f92
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReadFileEx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ReadFileScatter
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.WriteFile
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.WriteFileEx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.WriteFileGather
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SetEndOfFile
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8ffb
jmp 0x12db8ff1
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReadFileEx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ReadFileScatter
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8ff1
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SetEndOfFile
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db8ffb
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d91cc0
test eax, eax
jne 0x12db900d
call fcn.12d91ce0
test eax, eax
je 0x12db9032
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ReadFile
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9032
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12f9c620
test eax, eax
je 0x12db9268
call fcn.12f9c7b0
test eax, eax
je 0x12db910e
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateFileA
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9071
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3764
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db90ff
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReplaceFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db90ff
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDirectoryExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db90ff
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db90ff
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3770
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9191
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12db9191
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateFileA
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9134
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12f9c450
test eax, eax
je 0x12db9191
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.12f8c7b0
add esp, 4
test eax, eax
je 0x12db9191
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d37a0
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9188
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3788
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9191
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d37ac
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db91c8
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3794
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db91d2
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DeleteFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db925c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.RemoveDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db925c
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FindNextFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db925c
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.FindFirstFileExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db925c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9294
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebx
jmp 0x12db9294
cmp dword [esp + 0x74], ebp
jne 0x12db9294
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.LoadLibraryExW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9294
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateThread
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db92cc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.ExitThread
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db92fa
cmp dword [0x131a90c8], ebp
je 0x12db92fa
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12db92fa
push str.Capture_
push str.FastCopy
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.SetVolumeMountPointW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9328
call fcn.12d92240
test eax, eax
je 0x12db9328
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
call fcn.12d92270
test eax, eax
je 0x12db9372
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.RemoveDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9368
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9372
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d91a00
test eax, eax
jne 0x12db93a0
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DeviceIoControl
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db93a0
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d92090
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3654
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3644
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push 0x130d35c4
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9641
call fcn.12f9c620
test eax, eax
je 0x12db95ee
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DeleteFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db94a7
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.RemoveDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db94a7
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FindNextFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db94a7
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FindFirstFileExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db94a7
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDirectoryW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db94b1
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
cmp dword [esp + 0x74], ebp
je 0x12db94c9
call fcn.12f9c7b0
test eax, eax
je 0x12db94ee
call fcn.12f9c450
test eax, eax
je 0x12db94ee
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LoadLibraryExW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db94ee
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12f9c7b0
test eax, eax
je 0x12db95ee
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3764
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.ReplaceFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDirectoryExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3788
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3770
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CopyFile2
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db95e4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateFile2
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db95ee
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatMessageA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db962a
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FormatMessageW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92eb0
test eax, eax
jne 0x12db8e13
call fcn.12d92ed0
jmp 0x12db8e0b
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.ws2_32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db96d5
cmp dword [0x131998ec], ebp
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.connect
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db871f
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.WSAConnect
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db871f
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.shutdown
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
jmp 0x12dba170
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push 0x130d357c
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9a4a
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.gdi32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9a4a
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.user32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9a4a
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.Msimg32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9a4a
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.fmifs.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db97df
call fcn.12d91a00
test eax, eax
je 0x12dba170
cmp dword [esp + 0x88], ebp
je 0x12db97a5
cmp dword [0x13198f68], ebp
je 0x12dba170
push str.DllProcAttach_Format_dis_
push str.HookFormat
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12dba170
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.FormatEx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db8e13
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.FormatEx2
call fcn.12f5ec40
jmp 0x12db9997
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.ssleay32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db983a
call fcn.12d91a40
test eax, eax
je 0x12db9824
call fcn.12e562a0
test eax, eax
jne 0x12db8e13
push ebp
call fcn.12e563e0
and eax, 0x20
add esp, 4
cmp al, 0x20
je 0x12db8e13
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.tray.exe
jmp 0x12db9991
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.wininet.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.srvcli.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db987d
call fcn.12d920e0
jmp 0x12db99f2
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.ShLwApi.dll
call fcn.12f5ec40
mov edx, dword [0x130d2ab8]
add esp, 8
test eax, eax
jne 0x12db994b
mov eax, dword [esi + edx + 4]
push eax
push str.SHCreateStreamOnFileW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db98de
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.wmplayer.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SHCreateStreamOnFileEx
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9919
call fcn.12d91a00
test eax, eax
je 0x12dba170
call fcn.12f9c620
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SHSimulateDrop
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
jmp 0x12dba166
mov eax, dword [esi + edx]
push eax
push str.Mfplat.dll
call fcn.12f5ec40
mov ecx, dword [0x130d2ab8]
add esp, 8
test eax, eax
jne 0x12db99b0
mov edx, dword [esi + ecx + 4]
push edx
push str.MFBeginCreateFile
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x12dba170
push str.wmplayer.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12dba170
mov edx, dword [esi + ecx]
push edx
push str.windows.storage.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
mov eax, dword [0x130d2ab8]
jne 0x12db9a2a
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHFileOperationWithAdditionalFlags
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9a09
call fcn.12f9c7b0
test eax, eax
je 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SHCreateItemFromParsingName
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
jmp 0x12db99e0
mov ecx, dword [esi + eax]
push ecx
push 0x130d3600
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12d92090
jmp 0x12db99f2
call fcn.12d91bc0
test eax, eax
jne 0x12db9ebd
call fcn.12f9c450
test eax, eax
je 0x12db9a6d
call fcn.12d91de0
test eax, eax
jne 0x12db9ebd
call fcn.12d92010
test eax, eax
jne 0x12db9ebd
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push 0x130d357c
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.gdi32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9ba0
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.StartDocW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.EndPage
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.StartPage
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDCW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateDCA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.EndDoc
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.Escape
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.ExtEscape
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9baa
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebx
call fcn.12d92250
test eax, eax
je 0x12db9bf3
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax]
push ecx
push str.gdi32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9bf3
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.BitBlt
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9bf3
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx]
push eax
push str.user32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDialogIndirectParamW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9c5e
cmp dword [0x1319872c], ebp
jne 0x12db9c50
cmp dword [0x13199d64], ebp
jne 0x12db9c50
mov ecx, 0x131bdc68
call fcn.12e98560
test eax, eax
je 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DispatchMessageA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e93
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DispatchMessageW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e93
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetClipboardData
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9cc8
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
jmp 0x12db9ec6
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetWindowTextW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9d30
mov ecx, 0x131bdc68
mov dword [esp + 0x1c], ebp
call fcn.12e98560
test eax, eax
jne 0x12db9eb1
push ebp
call fcn.12d91b20
add esp, 4
test eax, eax
jne 0x12db9eb1
lea ecx, [esp + 0x1c]
push ecx
call fcn.12f37830
add esp, 4
test eax, eax
je 0x12db9d26
cmp dword [esp + 0x1c], ebx
je 0x12db9eb1
call fcn.12d92ef0
jmp 0x12db9ead
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DestroyWindow
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9d98
mov ecx, 0x131bdc68
mov dword [esp + 0x1c], ebp
call fcn.12e98560
test eax, eax
jne 0x12db9d8a
mov ecx, 0x131c4c08
call fcn.12f1ac80
test eax, eax
jne 0x12db9d8a
lea edx, [esp + 0x1c]
push edx
call fcn.12f37830
add esp, 4
test eax, eax
je 0x12db9ec6
cmp dword [esp + 0x1c], ebx
jne 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
jmp 0x12db9ec6
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.EmptyClipboard
call fcn.12f5ec40
add esp, 8
test eax, eax
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
jne 0x12db9dcd
mov ecx, 0x131b62a8
call fcn.12e57fc0
jmp 0x12db9ead
push str.EnumWindows
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9de9
cmp dword [0x13199d60], ebp
jmp 0x12db9eaf
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateWindowExA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e8b
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.CreateWindowExW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e8b
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.CreateDialogIndirectParamA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e8b
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.CreateWindowInBandEx
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9e8b
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.GetWindow
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9ec6
cmp dword [0x13199d64], ebp
jmp 0x12db9eaf
call fcn.12d91a00
test eax, eax
jne 0x12db9ebd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
push ecx
call fcn.12f37830
add esp, 4
test eax, eax
je 0x12db9ec6
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
jmp 0x12db9ec6
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebx
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx]
push edx
push str.user32.dll
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.SwitchDesktop
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9f1c
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetThreadDesktop
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9f45
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12db9f3b
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
jne 0x12db9f45
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SendMessageTimeoutW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9fb4
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.DdeConnect
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9fb4
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.DdeConnectList
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12db9fb4
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.DdeDisconnect
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12db9fe3
cmp dword [esp + 0x70], ebp
je 0x12db9fe3
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12db9fd9
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
jne 0x12db9fe3
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov ecx, 0x131b5300
call fcn.12e3e140
test eax, eax
je 0x12dba06a
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.PeekMessageW
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba060
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push str.GetKeyState
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba060
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.EmptyClipboard
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba060
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetClipboardData
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba06a
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.SetClipboardData
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba0c1
call fcn.12e879f0
cmp dword [0x131bcaec], ebp
je 0x12dba09d
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12d92ea0
test eax, eax
je 0x12dba0c1
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
je 0x12dba0c1
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.TrackPopupmenu
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba0ef
call fcn.12d92f10
test eax, eax
je 0x12dba0ef
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
call fcn.12d92de0
test eax, eax
je 0x12dba11d
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.IsClipboardFormatAvailable
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba11d
mov edx, dword [0x130d2ab8]
mov dword [esi + edx + 0x10], ebp
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push str.LoadStringA
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba154
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push str.LoadStringW
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba170
call fcn.12f9c6c0
test eax, eax
je 0x12dba170
call fcn.12d91a00
test eax, eax
je 0x12dba170
mov ecx, dword [0x130d2ab8]
mov dword [esi + ecx + 0x10], ebp
call fcn.12e75b30
test eax, eax
je 0x12dba215
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3880
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba215
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130d3870
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba215
mov eax, dword [0x130d2ab8]
mov ecx, dword [esi + eax + 4]
push ecx
push 0x130d3858
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba215
mov edx, dword [0x130d2ab8]
mov eax, dword [esi + edx + 4]
push eax
push 0x130d3764
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba215
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130cfd18
call fcn.12f5ec40
add esp, 8
test eax, eax
je 0x12dba215
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
call fcn.12e497d0
test eax, eax
je 0x12dba26c
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
lea ecx, [esp + 0x10]
push edx
call fcn.12f46920
mov eax, dword [eax]
mov byte [esp + 0x254], 0x64
push eax
call fcn.12e49840
add esp, 4
lea ecx, [esp + 0x10]
test eax, eax
sete bl
mov byte [esp + 0x254], 0x5b
call fcn.12f47220
test bl, bl
je 0x12dba26c
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], 3
mov ecx, dword [0x130d2ab8]
mov edx, dword [esi + ecx + 4]
push edx
push 0x130cfd18
call fcn.12f5ec40
add esp, 8
test eax, eax
jne 0x12dba291
mov eax, dword [0x130d2ab8]
mov dword [esi + eax + 0x10], ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [0x130d2abc]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x12db83ef
or edi, 0xffffffff
mov ecx, 0x1319a640
call fcn.12dc8720
call fcn.12ddb950
call fcn.12e9f3b0
call fcn.12d920a0
test eax, eax
jne 0x12dba2ea
push ebp
push 1
call fcn.12e8bc00
add esp, 8
test eax, eax
je 0x12dba2ea
call fcn.12e497d0
test eax, eax
jne 0x12dba2ea
push 1
call fcn.12e8aed0
add esp, 4
mov ecx, 0x131b7c00
call fcn.12e62290
call fcn.12f053c0
call fcn.12d920a0
test eax, eax
jne 0x12dba3cd
lea ecx, [esp + 0x4c]
xor esi, esi
call fcn.12e9bef0
push 1
push ebp
push ecx
mov bl, 0x65
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.tmailhook_taccctrlstart
mov byte [esp + 0x264], bl
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12dba359
lea ecx, [esp + 0x4c]
call fcn.12e9c660
cmp eax, 1
je 0x12dba38a
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Safe_HostAddr_Redirection_To_SoftGateway
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12dba399
mov esi, 1
call fcn.12eb2ab0
mov dword [0x13199d58], eax
cmp dword [0x13198f68], ebp
je 0x12dba3bc
mov ecx, dword [0x13199d58]
push ecx
push esi
push str.TAccCtrlStart___d___d_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x4c]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c060
mov ecx, 0x131c4460
call fcn.12f11070
mov eax, dword [0x13198f68]
xor edi, edi
cmp eax, ebp
je 0x12dba3f6
push str.DllProcAttach____5
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
push 1
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
jne 0x12dba418
mov ecx, 0x131c0830
call fcn.12ec0850
test eax, eax
je 0x12dba500
push 0xffffffffffffffff
mov ecx, 0x131c0830
call fcn.12ec0f00
push 0xffffffffffffffff
mov ecx, 0x131c0830
mov ebx, eax
call fcn.12ec0e80
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12dba453
push ebx
push esi
push str.DllProcAttach____6__SCDTProcType_d___Identify_08x_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp esi, 1
je 0x12dba46b
cmp esi, 4
je 0x12dba46b
cmp esi, 5
je 0x12dba46b
test bl, 0x92
je 0x12dba4f1
push 0xffffffffffffffff
mov ecx, 0x131c0830
call fcn.12ec0e80
push eax
call fcn.12ec0a20
add esp, 4
test eax, eax
je 0x12dba4e7
lea ecx, [esp + 0x10]
call fcn.12eaaa90
mov edx, dword [0x13196cc4]
lea eax, [esp + 0x70]
push 1
mov byte [esp + 0x258], 0x68
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x78], edx
call fcn.12eabc30
mov eax, dword [0x13198f68]
mov edi, 1
cmp eax, ebp
je 0x12dba4d6
mov ecx, dword [esp + 0x70]
push ecx
push str.CTSCDTGlobalMgr::StartSandbox_add_WorkspaceAddProc__PID_d_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x254], 0x5b
call fcn.12eaaac0
mov ecx, 0x131c0830
call fcn.12ec2110
push ebp
mov ecx, 0x131c0830
call fcn.12ec1af0
cmp edi, ebp
jne 0x12dba579
push 0xffffffffffffffff
mov ecx, 0x131c0830
call fcn.12ec0f00
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12dba52c
push esi
push str.CTSCDTGlobalMgr::StartSandbox____7__identify_08x_
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test esi, 0x20000000
je 0x12dba579
lea ecx, [esp + 0xb0]
call fcn.12eaaa90
mov edx, dword [0x13196cc4]
lea eax, [esp + 0x10]
push 1
mov byte [esp + 0x258], 0x69
push eax
lea ecx, [esp + 0xb8]
mov dword [esp + 0x18], edx
call fcn.12eabc30
lea ecx, [esp + 0xb0]
mov byte [esp + 0x254], 0x5b
call fcn.12eaaac0
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12dba5a9
push 0x8000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12dba5a9
push 5
call fcn.12e6f210
add esp, 4
test eax, eax
jne 0x12dba5df
call fcn.12d91c00
test eax, eax
jne 0x12dba5ba
cmp dword [0x1319990c], ebp
je 0x12dba5c3
call fcn.12d91c20
test eax, eax
je 0x12dba5c8
call fcn.12f2b610
call fcn.12d920a0
test eax, eax
jne 0x12dba5df
call fcn.12d91c00
test eax, eax
jne 0x12dba5df
call fcn.12f2b7d0
mov ecx, 0x131c7ef0
call fcn.12f36b50
test eax, eax
je 0x12dba5f7
mov ecx, 0x131c7dd0
call fcn.12f29ff0
push 0xffffffffffffffff
mov ecx, 0x131c0830
call fcn.12ec0e80
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12dba639
push esi
mov ecx, 0x131c0830
call fcn.12ec0920
push eax
call fcn.12d920a0
neg eax
sbb eax, eax
inc eax
push eax
push str.CTMailHookMgr::RegisterNetSecurityProc_0__d___d___d_
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
call fcn.12d920a0
test eax, eax
jne 0x12dba6eb
call fcn.12d91c00
test eax, eax
jne 0x12dba6eb
mov ebx, 1
cmp esi, ebx
je 0x12dba674
cmp esi, 4
je 0x12dba674
cmp esi, 5
je 0x12dba674
mov ecx, 0x131c0830
call fcn.12ec0920
test eax, eax
je 0x12dba6eb
call fcn.12eb2c20
mov edi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12dba699
push edi
push str.CTMailHookMgr::RegisterNetSecurityProc_1__d_
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp edi, ebp
je 0x12dba6eb
cmp esi, ebx
mov dword [0x131c0e90], ebx
je 0x12dba6b1
cmp esi, 4
je 0x12dba6b1
cmp esi, 5
jne 0x12dba6b7
mov dword [0x131c0e94], ebx
mov ecx, 0x131c0830
call fcn.12ecd810
push 0x12ed6c30
call fcn.12eb2c40
mov eax, dword [0x13198f68]
add esp, 4
cmp eax, ebp
je 0x12dba6eb
push str.CTMailHookMgr::RegisterNetSecurityProc_2
push str.scdt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov esi, 1
mov dword [0x131998b0], esi
call fcn.12db3740
call fcn.12db37f0
mov ecx, 0x131be530
call fcn.12e9e4b0
mov ecx, 0x131aa208
call fcn.12e1da00
push ebp
call fcn.12e62c60
mov ecx, eax
call fcn.12e62d40
mov ecx, 0x131bdc68
call fcn.12e985b0
mov ecx, 0x131bcad0
call fcn.12e87830
mov ecx, 0x13190e80
call fcn.12d81620
mov ecx, 0x131bcff0
call fcn.12e8f940
mov ecx, 0x131bdba0
call fcn.12e965b0
mov ecx, 0x131b7f78
call fcn.12e6c400
mov ecx, 0x131be4f8
call fcn.12e9d800
mov ecx, 0x131c3898
call fcn.12ef2310
lea ecx, [esp + 0xd4]
call fcn.12e9bef0
push esi
push ebp
push ecx
mov bl, 0x6a
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_udisk_encrypt_mode
mov byte [esp + 0x264], bl
call fcn.12f46a80
lea ecx, [esp + 0xe0]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0xd4]
call fcn.12e9c170
test eax, eax
je 0x12dba7e1
lea ecx, [esp + 0xd4]
call fcn.12e9c660
cmp eax, esi
je 0x12dba7dc
cmp eax, 2
je 0x12dba7dc
cmp eax, 3
mov dword [0x131a8f50], ebp
jne 0x12dba7e1
mov dword [0x131a8f50], eax
push esi
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_udisk_encrypt_ignore_type
call fcn.12f46a80
lea ecx, [esp + 0xe0]
mov byte [esp + 0x260], bl
call fcn.12e9c100
lea ecx, [esp + 0xd4]
call fcn.12e9c170
test eax, eax
je 0x12dba83a
lea ecx, [esp + 0xd4]
call fcn.12e9c660
cmp eax, esi
jne 0x12dba82f
mov dword [0x131a8f54], esi
jmp 0x12dba83a
cmp eax, 2
jne 0x12dba83a
mov dword [0x131a8f54], ebp
cmp dword [0x13198f68], ebp
je 0x12dba864
mov ecx, dword [0x131a8f54]
mov edx, dword [0x131a8f50]
push ecx
push edx
push 0x130d3b6c
push str.udisk
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov esi, dword [esp + 0x78]
cmp esi, ebp
je 0x12dba87c
mov ecx, esi
call fcn.12ebae00
push esi
call fcn.12f5bf80
add esp, 4
lea ecx, [esp + 0x7c]
call fcn.12daa2c0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x254], 0x6d
call fcn.12daa3c0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x254], bl
call fcn.12daa2f0
lea ecx, [esp + 0xd4]
mov byte [esp + 0x254], 0x5b
call fcn.12e9c060
lea ecx, [esp + 0x130]
mov byte [esp + 0x254], 0x70
call fcn.12f47220
lea ecx, [esp + 0x12c]
mov byte [esp + 0x254], 0x6f
call fcn.12f47220
mov esi, dword [esp + 0x11c]
mov byte [esp + 0x254], 0x6e
cmp esi, ebp
je 0x12dba967
mov eax, dword [esp + 0x120]
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x12dba95c
lea ebp, [eax]
mov byte [esp + 0x254], 0x72
mov edi, dword [esi + 0x14]
test edi, edi
je 0x12dba93b
mov eax, dword [esi + 0x18]
mov ecx, eax
dec eax
test ecx, ecx
je 0x12dba92f
lea ebx, [eax + 1]
mov ecx, edi
call fcn.12dbace0
add edi, 0x14
dec ebx
jne 0x12dba922
mov eax, dword [esi + 0x14]
push eax
call fcn.12f5bf80
add esp, 4
lea ecx, [esi + 4]
mov byte [esp + 0x254], 0x6e
call fcn.12f4cbb0
add esi, 0x24
dec ebp
mov dword [esp + 0x10], esi
jne 0x12dba906
mov esi, dword [esp + 0x11c]
push esi
call fcn.12f5bf80
add esp, 4
xor ebp, ebp
mov esi, dword [esp + 0x10c]
mov byte [esp + 0x254], 0x74
cmp esi, ebp
je 0x12dba9c5
mov eax, dword [esp + 0x110]
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x12dba9bc
lea edi, [eax]
mov bl, 0x76
lea ecx, [esi + 4]
mov byte [esp + 0x254], bl
call fcn.12f4cbb0
mov ecx, esi
mov byte [esp + 0x254], 0x74
call fcn.12f47220
add esi, 0x14
dec edi
mov dword [esp + 0x10], esi
jne 0x12dba98d
mov esi, dword [esp + 0x10c]
push esi
call fcn.12f5bf80
add esp, 4
lea ecx, [esp + 0xfc]
mov byte [esp + 0x254], 0x5a
call fcn.12f4cbb0
lea ecx, [esp + 0xc8]
mov dword [esp + 0x254], 0xffffffff
call fcn.12dac690
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x248
ret