Function at 0x5a54e1
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
jae 0x5a54df
jmp 0x5a54da
call fcn.005a54e1
jae 0x5a54da
add esp, 4
jmp 0x5a54e6
dec dword [esp]
jno 0x5a54eb
jns 0x5a54d6
jp 0x5a54ef
add esp, 4
popf
jmp 0x5a54f6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a550f
jne 0x5a550f
call 0x101a8863
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 4], 0
push 0x37f0ea5
lea ecx, [ebp - 0x441]
call fcn.005a4270
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x441]
call fcn.00594a60
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xc], 0
jne 0x5a557b
mov dword [ebp - 4], 1
push 0x4bf71b5f
lea ecx, [ebp - 0x44d]
call fcn.005a42c0
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x9ac]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x264], eax
lea ecx, [ebp - 0x44d]
call fcn.005a3850
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x264], 0
jne 0x5a55d5
mov dword [ebp - 4], 0x1b
push 0x6c34a05f
lea ecx, [ebp - 0x458]
call fcn.005a4310
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x9b0]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x178], eax
lea ecx, [ebp - 0x458]
call fcn.00594b30
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x178], 0
jne 0x5a563c
push str.WinAPITable__OpenThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
mov eax, 0xb3861d3d
push eax
lea ecx, [ebp - 0x468]
call fcn.005a43a0
mov dword [ebp - 0x9b4], eax
mov ecx, dword [ebp - 0x9b4]
push ecx
mov edx, dword [0x7a29ec]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x158], eax
lea ecx, [ebp - 0x468]
call fcn.00594a50
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x158], 0
jne 0x5a56a4
push str.WinAPITable__OpenThreadToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x17e50a04
lea ecx, [ebp - 0x474]
call fcn.005a43f0
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x9b8]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x17c], eax
lea ecx, [ebp - 0x474]
call fcn.005a3850
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x17c], 0
jne 0x5a570b
push str.WinAPITable__OpenProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
mov eax, 0xfb0df2cf
push eax
lea ecx, [ebp - 0x488]
call fcn.005a4440
mov dword [ebp - 0x9bc], eax
mov ecx, dword [ebp - 0x9bc]
push ecx
mov edx, dword [0x7a29ec]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x180], eax
lea ecx, [ebp - 0x488]
call fcn.00594ad0
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x180], 0
jne 0x5a5773
push str.WinAPITable__MultiByteToWideChar_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x33d85807
lea ecx, [ebp - 0x4a3]
call fcn.005a4490
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x9c0]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x184], eax
lea ecx, [ebp - 0x4a3]
call fcn.00594a80
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x184], 0
jne 0x5a57da
push str.WinAPITable__WinStationTerminateProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x285c56bd
lea ecx, [ebp - 0x4af]
call fcn.005a44e0
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xbc], eax
lea ecx, [ebp - 0x4af]
call fcn.005a3850
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xbc], 0
jne 0x5a5841
push str.WinAPITable__CloseHandle_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
mov eax, 0xb1bb2d0e
push eax
lea ecx, [ebp - 0x4bd]
call fcn.005a4530
mov dword [ebp - 0x9c8], eax
mov ecx, dword [ebp - 0x9c8]
push ecx
mov edx, dword [0x7a29ec]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x154], eax
lea ecx, [ebp - 0x4bd]
call fcn.00594ac0
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x154], 0
jne 0x5a58fd
mov eax, 0xdfa41f1e
push eax
lea ecx, [ebp - 0x4cb]
call fcn.005a4580
mov dword [ebp - 0x9cc], eax
mov ecx, dword [ebp - 0x9cc]
push ecx
mov edx, dword [0x7a29ec]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x154], eax
lea ecx, [ebp - 0x4cb]
call fcn.00594ac0
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x154], 0
jne 0x5a58fd
push str.WinAPITable__EnumProcesses_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x1b3357e5
lea ecx, [ebp - 0x4e1]
call fcn.005a45d0
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
push eax
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1dc], eax
lea ecx, [ebp - 0x4e1]
call fcn.005949a0
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1dc], 0
jne 0x5a5964
push str.WinAPITable__LookupPrivilegeValueA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.GetProcessImageFileNameA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x168], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x168], 0
jne 0x5a59a6
push str.WinAPITable__GetProcessImageFileNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.GetModuleFileNameExA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x16c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x16c], 0
jne 0x5a59ea
push str.WinAPITable__GetModuleFileNameExA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.GetLogicalDriveStringsA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x170], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x170], 0
jne 0x5a5a2c
push str.WinAPITable__GetLogicalDriveStringsA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66d110
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x174], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x174], 0
jne 0x5a5a70
push str.WinAPITable__GetModuleFileNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66d0d0
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x14], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x14], 0
jne 0x5a5aac
push str.WinAPITable__IsDebuggerPresent_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66d09c
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x18], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x18], 0
jne 0x5a5aea
push str.WinAPITable__Sleep_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtQueryInformationThread
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x10c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x10c], 0
jne 0x5a5b2c
push str.WinAPITable__NtQueryInformationThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtQuerySystemInformation
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x28], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x28], 0
jne 0x5a5b6a
push str.WinAPITable__NtQuerySystemInformation_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtDuplicateObject
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2c], 0
jne 0x5a5ba6
push str.WinAPITable__NtDuplicateObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtClose
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x30], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x30], 0
jne 0x5a5be4
push str.WinAPITable__NtClose_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtGetContextThread
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x94], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x94], 0
jne 0x5a5c26
push str.WinAPITable__NtGetContextThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtSetContextThread
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x98], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x98], 0
jne 0x5a5c6a
push str.WinAPITable__NtSetContextThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtReadVirtualMemory
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x9c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x9c], 0
jne 0x5a5cac
push str.WinAPITable__NtReadVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtWaitForSingleObject
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xa0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xa0], 0
jne 0x5a5cf0
push str.WinAPITable__NtWaitForSingleObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtUnmapViewOfSection
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0xa4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0xa4], 0
jne 0x5a5d32
push str.WinAPITable__NtUnmapViewOfSection_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtWriteVirtualMemory
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xa8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xa8], 0
jne 0x5a5d76
push str.WinAPITable__NtWriteVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtResumeThread
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0xb4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0xb4], 0
jne 0x5a5db8
push str.WinAPITable__NtResumeThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtTerminateProcess
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x100], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x100], 0
jne 0x5a5dfc
push str.WinAPITable__NtTerminateProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.RtlAdjustPrivilege
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x104], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x104], 0
jne 0x5a5e3e
push str.WinAPITable__RtlAdjustPrivilege_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtQueryInformationProcess
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x108], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x108], 0
jne 0x5a5e82
push str.WinAPITable__NtQueryInformationProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.ZwSetInformationThread
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x110], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x110], 0
jne 0x5a5ec4
push str.WinAPITable__ZwSetInformationThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtQueryVirtualMemory
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x114], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x114], 0
jne 0x5a5f08
push str.WinAPITable__NtQueryVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtAdjustPrivilegesToken
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x118], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x118], 0
jne 0x5a5f4a
push str.WinAPITable__NtAdjustPrivilegesToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtOpenProcessToken
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x11c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x11c], 0
jne 0x5a5f8e
push str.WinAPITable__NtOpenProcessToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.RtlGetVersion
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x120], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x120], 0
jne 0x5a5fd0
push str.WinAPITable__RtlGetVersion_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
mov dword [ebp - 0x634], 0x11c
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x624], 0
xor ecx, ecx
mov word [ebp - 0x620], cx
push 0xfe
push 0
lea edx, [ebp - 0x61e]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x520], ax
xor ecx, ecx
mov word [ebp - 0x51e], cx
xor edx, edx
mov dword [ebp - 0x51c], edx
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], edx
mov eax, 6
movzx ecx, ax
mov dword [ebp - 0x630], ecx
mov edx, 2
movzx eax, dx
mov dword [ebp - 0x62c], eax
xor ecx, ecx
mov word [ebp - 0x520], cx
mov edx, dword [ebp - 0x514]
push edx
mov eax, dword [ebp - 0x518]
push eax
push 0x23
lea ecx, [ebp - 0x634]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
neg eax
movzx edx, al
test edx, edx
je 0x5a60fe
push str.SetProcessMitigationPolicy
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x124], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x124], 0
jne 0x5a60fe
push str.WinAPITable__SetProcessMitigationPolicy_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
mov dword [ebp - 0x758], 0x11c
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x74c], 0
mov dword [ebp - 0x748], 0
xor ecx, ecx
mov word [ebp - 0x744], cx
push 0xfe
push 0
lea edx, [ebp - 0x742]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x644], ax
xor ecx, ecx
mov word [ebp - 0x642], cx
xor edx, edx
mov dword [ebp - 0x640], edx
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.ntdll.dll_VerSetConditionMask]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], edx
mov eax, 6
movzx ecx, ax
mov dword [ebp - 0x754], ecx
xor edx, edx
movzx eax, dx
mov dword [ebp - 0x750], eax
xor ecx, ecx
mov word [ebp - 0x644], cx
mov edx, dword [ebp - 0x638]
push edx
mov eax, dword [ebp - 0x63c]
push eax
push 0x23
lea ecx, [ebp - 0x758]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
neg eax
movzx edx, al
test edx, edx
je 0x5a6229
push str.CsrGetProcessId
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x128], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x128], 0
jne 0x5a6229
push str.WinAPITable__CsrGetProcessId_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtSetInformationDebugObject
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x12c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x12c], 0
jne 0x5a626d
push str.WinAPITable__NtSetInformationDebugObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtRemoveProcessDebug
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x130], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x130], 0
jne 0x5a62af
push str.WinAPITable__NtRemoveProcessDebug_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtSuspendProcess
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x134], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x134], 0
jne 0x5a62f3
push str.WinAPITable__NtSuspendProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtResumeProcess
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x138], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x138], 0
jne 0x5a6335
push str.WinAPITable__NtResumeProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.RtlInitUnicodeString
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x148], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x148], 0
jne 0x5a6379
push str.WinAPITable__RtlInitUnicodeString_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.LdrLoadDll
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x13c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x13c], 0
jne 0x5a63bb
push str.WinAPITable__LdrLoadDll_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c9c0
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x144], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x144], 0
jne 0x5a63ff
push str.WinAPITable__CreateThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c988
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x188], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x188], 0
jne 0x5a6441
push str.WinAPITable__FindWindowExA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c944
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x18c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x18c], 0
jne 0x5a6485
push str.WinAPITable__GetWindowThreadProcessId_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c900
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x190], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x190], 0
jne 0x5a64c7
push str.WinAPITable__GetClassNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c8c8
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x194], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x194], 0
jne 0x5a650b
push str.WinAPITable__GetWindowTextA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.GetWindowsDirectoryA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x198], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x198], 0
jne 0x5a654d
push str.WinAPITable__GetWindowsDirectoryA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c83c
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1a0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1a0], 0
jne 0x5a6591
push str.WinAPITable__CreateToolhelp32Snapshot_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c7f8
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1a4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1a4], 0
jne 0x5a65d3
push str.WinAPITable__Process32First_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c7c0
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1a8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1a8], 0
jne 0x5a6617
push str.WinAPITable__Process32Next_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c788
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1ac], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1ac], 0
jne 0x5a6659
push str.WinAPITable__Module32First_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push 0x66c750
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1b0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1b0], 0
jne 0x5a669d
push str.WinAPITable__Module32Next_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1bc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1bc], 0
jne 0x5a66df
push str.WinAPITable__ConvertStringSecurityDescriptorToSecurityDescriptorA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.SetKernelObjectSecurity
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1c0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1c0], 0
jne 0x5a6723
push str.WinAPITable__SetKernelObjectSecurity_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.AllocateAndInitializeSid
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1cc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1cc], 0
jne 0x5a6765
push str.WinAPITable__AllocateAndInitializeSid_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtSetInformationProcess
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1d0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1d0], 0
jne 0x5a67a9
push str.WinAPITable__NtSetInformationProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.NtAllocateVirtualMemory
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1d4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1d4], 0
jne 0x5a67eb
push str.WinAPITable__NtAllocateVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5a8783
push str.lstrcmpiA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1c], 0
jne 0x5a681c
mov dword [ebp - 4], 4
push 0x66c558
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2fc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2fc], 0
jne 0x5a6851
mov dword [ebp - 4], 9
push str.CheckRemoteDebuggerPresent
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2f8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2f8], 0
jne 0x5a6888
mov dword [ebp - 4], 0x15
push 0x66c528
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1d8], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1d8], 0
jne 0x5a68bd
mov dword [ebp - 4], 0x17
push 0x66c51c
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x30c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x30c], 0
jne 0x5a68f4
mov dword [ebp - 4], 0x18
push 0x66c50c
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0xe4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0xe4], 0
jne 0x5a6929
mov dword [ebp - 4], 0x19
push 0x66c500
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x3c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x3c], 0
jne 0x5a695a
mov dword [ebp - 4], 0x24
push 0x66c4ec
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x10], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x10], 0
jne 0x5a6989
mov dword [ebp - 4], 0x26
push 0x66c4d8
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1c4], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1c4], 0
jne 0x5a69c0
mov dword [ebp - 4], 0x27
push 0x66c4c8
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1c8], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1c8], 0
jne 0x5a69f5
mov dword [ebp - 4], 0x28
push str.EnumDeviceDrivers
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xc4], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xc4], 0
jne 0x5a6a2c
mov dword [ebp - 4], 0x2b
push 0x66c4a4
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2e0], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2e0], 0
jne 0x5a6a61
mov dword [ebp - 4], 0x2c
push 0x66c498
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x238], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x238], 0
jne 0x5a6a98
mov dword [ebp - 4], 0x2d
push 0x66c488
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1e8], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1e8], 0
jne 0x5a6acd
mov dword [ebp - 4], 0x2e
push 0x66c478
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x26c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x26c], 0
jne 0x5a6b04
mov dword [ebp - 4], 0x30
push 0x66c468
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x234], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x234], 0
jne 0x5a6b39
mov dword [ebp - 4], 0x32
push str.CallNextHookEx
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xac], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xac], 0
jne 0x5a6b70
mov dword [ebp - 4], 0x33
push str.SetWindowsHookExA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0xb0], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0xb0], 0
jne 0x5a6ba5
mov dword [ebp - 4], 0x34
push str.AddVectoredExceptionHandler
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x5c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x5c], 0
jne 0x5a6bd6
mov dword [ebp - 4], 0x36
push str.VirtualQuery
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0xdc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0xdc], 0
jne 0x5a6c0b
mov dword [ebp - 4], 0x37
push str.MessageBoxTimeoutA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x270], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x270], 0
jne 0x5a6c42
mov dword [ebp - 4], 0x38
push 0x66c3f0
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x160], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x160], 0
jne 0x5a6c77
mov dword [ebp - 4], 0x3e
push str.CreateProcessA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x140], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x140], 0
jne 0x5a6cae
mov dword [ebp - 4], 0x3f
push 0x66c3d0
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x304], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x304], 0
jne 0x5a6ce3
mov dword [ebp - 4], 0x40
push 0x66c3c0
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x274], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x274], 0
jne 0x5a6d1a
mov dword [ebp - 4], 0x42
push 0x66c3ac
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2ec], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2ec], 0
jne 0x5a6d4f
mov dword [ebp - 4], 0x44
push 0x66c394
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x24c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x24c], 0
jne 0x5a6d86
mov dword [ebp - 4], 0x45
push str.GetMappedFileNameA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x200], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x200], 0
jne 0x5a6dbb
mov dword [ebp - 4], 0x46
push 0x66c374
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2d0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2d0], 0
jne 0x5a6df2
mov dword [ebp - 4], 0x48
push str.CallWindowProcA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2e8], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2e8], 0
jne 0x5a6e27
mov dword [ebp - 4], 0x4b
push str.IsWindowVisible
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x244], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x244], 0
jne 0x5a6e5e
mov dword [ebp - 4], 0x4e
push 0x66c344
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2f4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2f4], 0
jne 0x5a6e93
mov dword [ebp - 4], 0x51
push str.Thread32First
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x204], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x204], 0
jne 0x5a6eca
mov dword [ebp - 4], 0x52
push str.Thread32Next
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x208], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x208], 0
jne 0x5a6eff
mov dword [ebp - 4], 0x53
push str.NtQueryObject
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x308], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x308], 0
jne 0x5a6f36
mov dword [ebp - 4], 0x56
push 0x66c308
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x254], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x254], 0
jne 0x5a6f6b
mov dword [ebp - 4], 0x57
push str.FindFirstFileA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x290], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x290], 0
jne 0x5a6fa2
mov dword [ebp - 4], 0x58
push str.FindNextFileA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x294], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x294], 0
jne 0x5a6fd7
mov dword [ebp - 4], 0x59
push 0x66c2d4
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x298], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x298], 0
jne 0x5a700e
mov dword [ebp - 4], 0x5a
push str.RemoveDirectoryA
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x29c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x29c], 0
jne 0x5a7043
mov dword [ebp - 4], 0x5b
push 0x66c2b4
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2a0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2a0], 0
jne 0x5a707a
mov dword [ebp - 4], 0x5c
push 0x66c2a0
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x28c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x28c], 0
jne 0x5a70af
mov dword [ebp - 4], 0x5d
push str.FindClose
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2a4], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2a4], 0
jne 0x5a70e6
mov dword [ebp - 4], 0x5e
push 0x66c27c
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1dc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1dc], 0
jne 0x5a711b
mov dword [ebp - 4], 0x5f
push 0x66c264
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1e0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1e0], 0
jne 0x5a7152
mov dword [ebp - 4], 0x60
push 0x66c250
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x1e4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x1e4], 0
jne 0x5a7187
mov dword [ebp - 4], 0x61
push str.WNetGetProviderNameA
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x4c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x4c], 0
jne 0x5a71b8
mov dword [ebp - 4], 0x64
push 0x66c224
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x250], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x250], 0
jne 0x5a71ed
mov dword [ebp - 4], 0x6a
push str.GetTokenInformation
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1f8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1f8], 0
jne 0x5a7224
mov dword [ebp - 4], 0x6c
push 0x66c204
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x19c], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x19c], 0
jne 0x5a7259
mov dword [ebp - 4], 0x6d
push 0x66c1f4
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x20c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x20c], 0
jne 0x5a7290
mov dword [ebp - 4], 0x6e
push str.AddAccessDeniedAce
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x218], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x218], 0
jne 0x5a72c5
mov dword [ebp - 4], 0x6f
push str.AddAccessAllowedAce
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x21c], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x21c], 0
jne 0x5a72fc
mov dword [ebp - 4], 0x70
push 0x66c1bc
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x220], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x220], 0
jne 0x5a7331
mov dword [ebp - 4], 0x71
push str.FreeSid
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x1f4], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x1f4], 0
jne 0x5a7368
mov dword [ebp - 4], 0x72
push str.SetThreadContext
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x284], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x284], 0
jne 0x5a739d
mov dword [ebp - 4], 0x77
push str.SuspendThread
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0xb8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0xb8], 0
jne 0x5a73d4
mov dword [ebp - 4], 0x78
push str.BlockInput
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x278], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x278], 0
jne 0x5a7409
mov dword [ebp - 4], 0x7a
push str.RemoveVectoredExceptionHandler
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x50], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x50], 0
jne 0x5a743a
mov dword [ebp - 4], 0x7c
push 0x66c158
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2bc], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2bc], 0
jne 0x5a746f
mov dword [ebp - 4], 0x7f
push 0x66c144
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2c0], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2c0], 0
jne 0x5a74a6
mov dword [ebp - 4], 0x80
push 0x66c130
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x2c4], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x2c4], 0
jne 0x5a74db
mov dword [ebp - 4], 0x81
push str.UnhookWindowsHookEx
mov ecx, dword [0x7a29ec]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7a29f0]
mov dword [ecx + 0x2c8], eax
mov edx, dword [0x7a29f0]
cmp dword [edx + 0x2c8], 0
jne 0x5a7512
mov dword [ebp - 4], 0x82
push str.EndTask
mov eax, dword [0x7a29ec]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7a29f0]
mov dword [edx + 0x240], eax
mov eax, dword [0x7a29f0]
cmp dword [eax + 0x240], 0
jne 0x5a7547
mov esp, ebp
pop ebp
ret