Function at 0x10059ce0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get thread local storage value
Query environment variable
Resolve function by parsing pe exports
Resume thread
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10086b1e
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x30]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x4c], eax
movdqu xmmword [esp + 0x9c], xmm0
cmp byte [0x100b0b26], al
je 0x10059f59
mov edx, str._In_MsiTracker_mode_
call fcn.100394f0
test ebx, ebx
je 0x10059da4
mov ecx, ebx
call fcn.100446e0
test eax, eax
jne 0x10059dbb
test edi, edi
je 0x10059f0f
mov ecx, edi
call fcn.100446e0
test eax, eax
je 0x10059f0f
mov edx, str.MsiTracker___MSIEXEC_launch_detected__
call fcn.100394f0
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x74]
or eax, 4
push esi
push edx
push dword [esp + 0x4c]
push dword [esp + 0x54]
push eax
push dword [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x7c]
push edi
push ebx
cmp ecx, 0xffffffff
jne 0x10059dfa
call dword [0x100b109c]
jmp 0x10059e01
push ecx
call dword [0x100b10a0]
push dword [esi]
mov edi, eax
lea eax, [esp + 0x40]
push edi
push str.MsiTracker__CreateProcessAsUserWNext_returned__d:_lpProcessInformation__hProcess0x_x
push eax
call fcn.1003a800
add esp, 0x10
mov dword [esp + 0x1c0], 0
mov edx, dword [eax]
call fcn.100394f0
mov dword [esp + 0x1c0], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [esp + 0x3c]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10059e55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x10059f08
lea ecx, [esp + 0x5c]
call fcn.10064ef0
mov dword [esp + 0x1c0], 1
xor eax, eax
cmp dword [0x100b2cf0], eax
mov edx, dword [esi]
mov ecx, dword [esp + 0x5c]
setne al
push eax
push dword [esi + 8]
call fcn.100426c0
push eax
lea eax, [esp + 0x48]
push str.MsiTracker__InjectLibrary_returned__d
push eax
call fcn.1003a800
add esp, 0x14
mov byte [esp + 0x1c0], 2
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 1
mov ecx, ebx
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10059ed2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x1c0], 0xffffffff
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x10059ef8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x2c], 4
jne 0x10059f08
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
jmp 0x1005ba62
mov edx, str.MsiTracker_mode_only:_skipping_hook
call fcn.100394f0
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x74]
push esi
push edx
push dword [esp + 0x4c]
push dword [esp + 0x54]
push dword [esp + 0x3c]
push dword [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x7c]
push edi
push ebx
cmp eax, 0xffffffff
jne 0x10059f4d
call dword [0x100b109c]
jmp 0x1005ba62
push eax
call dword [0x100b10a0]
jmp 0x1005ba62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x100af300]
mov dword [esp + 0x90], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [0x100af305], 0
mov dword [esp + 0x94], eax
je 0x10059f19
test al, 1
je 0x10059fc7
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x74]
push esi
push edx
push dword [esp + 0x4c]
push dword [esp + 0x54]
push dword [esp + 0x3c]
push dword [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x7c]
push edi
push ebx
cmp eax, 0xffffffff
jne 0x10059f4d
call dword [0x100b109c]
jmp 0x1005ba62
or eax, 1
push eax
push dword [0x100af300]
mov dword [esp + 0x80], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.10021470
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x10059ffa
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c0], 3
call fcn.10021470
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1005a02d
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x1c0], 4
call fcn.10021470
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1005a05d
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c0], 5
lea ecx, [esp + 0x88]
mov dword [esp + 0x84], 0
call fcn.10064ef0
lea ecx, [esp + 0x98]
mov byte [esp + 0x1c0], 6
call fcn.10064f80
push dword [esp + 0x74]
mov edx, dword [esp + 0x58]
lea eax, [esp + 0xa0]
push 0x44
mov byte [esp + 0x1c8], 7
test esi, esi
push dword [edx]
cmovne eax, esi
push dword [esp + 0x38]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x34]
push dword [esp + 0x68]
push dword [esp + 0x58]
push edi
push dword [esp + 0x54]
push str.ApiInit:_lpApplicationName_slpCommandLine_slpCurrentDirectory_sbInheritHandles_ddwCreationFlags0x_xStartupInfo.cb_d_known_d_hToken_x
push eax
call fcn.1003a800
add esp, 0x28
mov byte [esp + 0x1c0], 8
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 7
or esi, 0xffffffff
mov edx, dword [esp + 0x24]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005a11a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x54]
cmp dword [eax], 0x44
jb 0x1005a17b
push dword [eax + 0x34]
push dword [eax + 4]
push dword [eax + 8]
push dword [eax + 0x40]
push dword [eax + 0x3c]
push dword [eax + 0x38]
lea eax, [esp + 0x3c]
push str.ApiInit_cont_:_StartupInfo:_StdIn_xStdOut_xStdErr_dDesk_pReserved_pReserved2_x
push eax
call fcn.1003a800
add esp, 0x20
mov byte [esp + 0x1c0], 9
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 7
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a17b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
call fcn.10059580
mov byte [esp + 0x1c0], 0xa
push dword [eax]
lea eax, [esp + 0x60]
push str.Remarkable_dwCreationFlags_flags:__s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0xb
mov edx, dword [esp + 0x5c]
call fcn.100394f0
mov byte [esp + 0x1c0], 0xa
mov ecx, esi
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a1da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 7
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a1ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1005a488
test edi, edi
je 0x1005a488
push eax
lea ecx, [esp + 0x24]
call fcn.10022c70
lea ecx, [esp + 0x20]
call fcn.100231c0
mov ecx, eax
call fcn.10023240
push 0x22
push 0x22
lea ecx, [esp + 0x28]
call fcn.1002d4f0
mov ecx, eax
call fcn.10037c70
lea ecx, [esp + 0x5c]
call fcn.10022b60
push 1
push ecx
mov ecx, esp
mov byte [esp + 0x1c8], 0xc
push edi
call fcn.10022bb0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x64]
call fcn.10028630
add esp, 8
lea ecx, [esp + 0x18]
call fcn.100231c0
mov ecx, eax
call fcn.10023240
mov edi, dword [esp + 0x18]
add edi, 0xfffffff0
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x1005a2d2
cmp dword [edi + 0xc], 0
jl 0x1005a2c5
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1005a2c5
call fcn.100236e0
mov dword [esp + 0x24], eax
lea ecx, [edi + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005a2b8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x24]
add eax, 0x10
mov dword [esp + 0x18], eax
jmp 0x1005a2d2
push dword [edx - 0xc]
lea ecx, [esp + 0x1c]
push edx
call fcn.10023530
push 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
call fcn.10022df0
mov edx, 0x1009e1b4
mov byte [esp + 0x1c0], 0xd
mov ecx, eax
call fcn.10037960
mov byte [esp + 0x1c0], 0xc
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
mov byte [esp + 0x37], al
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a31f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x37], 0
je 0x1005a3cc
push 0x22
lea ecx, [esp + 0x1c]
call fcn.10037c70
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
lea ecx, [edx - 0x10]
lea edi, [eax - 0x10]
cmp ecx, edi
je 0x1005a38e
cmp dword [edi + 0xc], 0
jl 0x1005a37d
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1005a37d
call fcn.100236e0
mov dword [esp + 0x24], eax
lea ecx, [edi + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005a370
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x24]
add eax, 0x10
mov dword [esp + 0x18], eax
jmp 0x1005a38e
push dword [edx - 0xc]
lea ecx, [esp + 0x1c]
push edx
call fcn.10023530
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jle 0x1005a461
push 0x22
push eax
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x1005a461
sub eax, dword [esp + 0x18]
sar eax, 1
cmp eax, 0xffffffff
je 0x1005a461
inc eax
lea ecx, [esp + 0x18]
push eax
push 0
call fcn.10022cf0
jmp 0x1005a461
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jle 0x1005a3fc
push 0x20
push eax
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x1005a3fc
sub eax, dword [esp + 0x18]
sar eax, 1
cmp eax, 0xffffffff
je 0x1005a3fc
push eax
push 0
lea ecx, [esp + 0x20]
call fcn.10022cf0
lea ecx, [esp + 0x18]
call fcn.100231c0
mov ecx, eax
call fcn.10023240
mov edi, dword [esp + 0x18]
add edi, 0xfffffff0
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x1005a461
cmp dword [edi + 0xc], 0
jl 0x1005a454
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1005a454
call fcn.100236e0
mov dword [esp + 0x24], eax
lea ecx, [edi + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005a447
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x24]
add eax, 0x10
mov dword [esp + 0x18], eax
jmp 0x1005a461
push dword [edx - 0xc]
lea ecx, [esp + 0x1c]
push edx
call fcn.10023530
mov byte [esp + 0x1c0], 7
mov ecx, esi
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a4e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1005a4e6
mov eax, dword [esp + 0x78]
and eax, 0xfffffffe
push eax
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1005a4b7
push 1
push ecx
mov ecx, esp
lea edi, [esp + 0x20]
push eax
call fcn.10022bb0
mov edx, edi
jmp 0x1005a4ca
test edi, edi
je 0x1005a4d6
push 1
push ecx
mov ecx, esp
push edi
call fcn.10022bb0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x28]
call fcn.10028630
add esp, 8
push dword [esp + 0x78]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x48]
lea eax, [esp + 0x28]
push dword [esp + 0x48]
push dword [esp + 0x28]
push 0x1009e1b8
push eax
call fcn.1003a800
add esp, 0x14
mov byte [esp + 0x1c0], 0xe
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 7
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a538
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x18]
call fcn.100231c0
mov ecx, eax
call fcn.10023240
mov edi, dword [esp + 0x18]
add edi, 0xfffffff0
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x1005a59d
cmp dword [edi + 0xc], 0
jl 0x1005a590
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1005a590
call fcn.100236e0
mov dword [esp + 0x24], eax
lea ecx, [edi + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005a583
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x24]
add eax, 0x10
mov dword [esp + 0x18], eax
jmp 0x1005a59d
push dword [edx - 0xc]
lea ecx, [esp + 0x1c]
push edx
call fcn.10023530
cmp dword [0x100b2d2c], 0
je 0x1005a70e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x1008fa70
call fcn.10022bb0
push ecx
mov byte [esp + 0x1c8], 0xf
mov ecx, esp
mov dword [esp + 0x24], esp
push str.cmd.exe
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x1cc], 0x10
call fcn.1003a340
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 7
call fcn.1003a550
add esp, 0xc
mov ecx, 1
mov byte [esp + 0x1c0], 0x11
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov ecx, dword [eax]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1005a624
push 0x80004005
call fcn.10021340
push ecx
push dword [esp + 0x24]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1005a672
push 3
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
call fcn.10022df0
mov ecx, 3
mov dword [esp + 0x1c0], 0x12
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov ecx, eax
push 0x1009e25c
call fcn.10022cc0
mov byte [esp + 0x37], 1
test eax, eax
je 0x1005a677
mov byte [esp + 0x37], 0
mov dword [esp + 0x1c0], 0x11
mov eax, dword [esp + 0x4c]
test al, 2
je 0x1005a6b6
mov edx, dword [esp + 0x24]
and eax, 0xfffffffd
add edx, 0xfffffff0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a6b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c0], 7
test al, 1
je 0x1005a6ed
mov edx, dword [esp + 0x6c]
and eax, 0xfffffffe
add edx, 0xfffffff0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a6ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x37], 0
je 0x1005a70e
mov edx, str._CreateProcessW:_hiding_cmd__c_black_window
call fcn.100394f0
mov eax, dword [esp + 0x2c]
and eax, 0xffffffe7
or eax, 0x8000000
mov dword [esp + 0x2c], eax
push 0xa28
call fcn.1006bba0
mov edi, eax
add esp, 4
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x78]
and eax, 0xfffffffe
push eax
push dword [0x100af300]
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push edi
push 0x514
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1005a75c
mov edx, str._GetFullPathName_failed:_0
call fcn.100394f0
jmp 0x1005a7c2
cmp eax, 0x514
jb 0x1005a7b2
mov eax, dword [esp + 0x20]
push dword [eax - 0xc]
lea eax, [esp + 0x28]
push str._GetFullPathName_failed:_insufficient_buffer__d
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x13
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 7
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005a7c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1005a7c2
cmp word [edi], 0
je 0x1005a7c2
push edi
lea ecx, [esp + 0x24]
call fcn.10022c70
push edi
call fcn.1006ac0c
add esp, 4
push dword [esp + 0x78]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ecx
mov ecx, esp
push str.CAMEYO_EXECREDIR
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x94]
call fcn.1003dc20
add esp, 4
mov byte [esp + 0x1c0], 0x14
call fcn.10021470
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1005a820
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x80], edi
mov byte [esp + 0x1c0], 0x15
call fcn.10021470
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1005a853
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x70], eax
push ecx
mov byte [esp + 0x1c4], 0x16
mov esi, esp
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
mov edx, 1
mov dword [esi], eax
call fcn.10027b80
mov ecx, esp
lea edx, [esp + 0x24]
push str..exe
mov esi, eax
call fcn.10022e60
add esp, 4
mov edx, 1
call fcn.10027b80
add esp, 4
cmp esi, 3
je 0x1005bb1f
cmp eax, 3
je 0x1005bb1f
mov eax, dword [esp + 0x90]
mov esi, 0x5c
cmp dword [eax - 0xc], 0
je 0x1005ac17
push eax
lea eax, [esp + 0x70]
push str.CreateProcessW:_ExecRedir:_checking__s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x18
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1c0], 0x16
call fcn.10022680
push ecx
mov ecx, dword [esp + 0x24]
movzx edi, si
mov esi, esp
mov dword [esp + 0x70], 0
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x28]
mov edx, edi
mov dword [esi], eax
call fcn.1003a890
add esp, 4
mov byte [esp + 0x1c0], 0x19
or ebx, 0xffffffff
mov ecx, 0x3b
nop
lea eax, [esp + 0x6c]
movzx edi, cx
push eax
push ecx
mov ecx, dword [esp + 0x98]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x58]
mov edx, edi
mov dword [esi], eax
call fcn.1003c8b0
add esp, 8
mov byte [esp + 0x1c0], 0x1a
cmp dword [esp + 0x6c], 0xffffffff
je 0x1005abf9
mov eax, dword [esp + 0x50]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x1005a9b3
lea edx, [eax - 0x10]
mov byte [esp + 0x1c0], 0x19
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
mov ecx, 0x3b
jg 0x1005a940
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1005a93a
jle 0x1005abde
push 0x3d
push eax
call fcn.1006ade1
mov esi, eax
add esp, 8
test esi, esi
je 0x1005abde
sub esi, dword [esp + 0x50]
sar esi, 1
cmp esi, 0xffffffff
je 0x1005abde
push esi
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x58]
call fcn.10022df0
mov byte [esp + 0x1c0], 0x1b
mov ecx, dword [esp + 0x50]
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
mov dword [esp + 0x40], eax
lea eax, [esi + 1]
mov byte [esp + 0x1c0], 0x1c
push eax
push 0
lea ecx, [esp + 0x48]
call fcn.10022cf0
mov edi, dword [esp + 0x7c]
lea ecx, [esp + 0x24]
push edi
call fcn.10022cc0
mov esi, dword [esp + 0x40]
test eax, eax
jne 0x1005ab69
cmp dword [esi - 0xc], eax
jne 0x1005aa52
push str.rundll32.exe
lea ecx, [esp + 0x44]
call fcn.10022c70
mov esi, dword [esp + 0x40]
push ecx
mov eax, esp
push dword [esp + 0x1c]
push esi
push dword [esp + 0x2c]
push str.CreateProcessW:_ExecRedir:_found_ExecRedir_match:__s______s___s
push eax
call fcn.1003a800
add esp, 0x14
call fcn.10021810
mov eax, esp
mov dword [esp + 0x20], esp
push dword [esp + 0x1c]
push esi
push dword [esp + 0x2c]
push str.ExecRedir:__s______s___s
push eax
call fcn.1003a800
add esp, 0x10
mov byte [esp + 0x1c8], 0x1d
mov ecx, esp
push str.CreateProcess
call fcn.10022bb0
xor ecx, ecx
mov byte [esp + 0x1c8], 0x1c
call fcn.10039770
mov eax, dword [esp + 0x28]
lea edx, [esi - 0x10]
add esp, 8
lea ecx, [eax - 0x10]
mov dword [esp + 0x38], ecx
cmp edx, ecx
je 0x1005ab1d
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [esp + 0x3c], eax
jl 0x1005ab0c
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1005ab0c
mov ecx, edx
call fcn.100236e0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1005aaff
mov edx, dword [esp + 0x38]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x1c]
add eax, 0x10
mov dword [esp + 0x20], eax
jmp 0x1005ab1d
push dword [esi - 0xc]
lea ecx, [esp + 0x24]
push esi
call fcn.10023530
mov eax, dword [esp + 0x20]
push dword [esp + 0x18]
mov dword [esp + 0x3c], 0
push eax
lea eax, [esp + 0x1c]
push str.__s___s
push eax
call fcn.1003a800
add esp, 0x10
mov ecx, eax
mov byte [esp + 0x1c0], 0x1e
call fcn.100231c0
mov ecx, eax
call fcn.10023240
push dword [eax]
call fcn.1006c1a9
add esp, 4
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x14]
call fcn.10022680
add esi, 0xfffffff0
mov byte [esp + 0x1c0], 0x1b
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005ab8a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x1c0], 0x1a
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005abab
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 0x19
mov ecx, ebx
mov edx, dword [esp + 0x50]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
mov ecx, 0x3b
jg 0x1005a940
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1005a93a
push ecx
mov eax, esp
push str.CreateProcessW:_ExecRedir:__error:_rule_doesnt_contain_
push eax
call fcn.1003a800
add esp, 8
call fcn.10021810
add esp, 4
jmp 0x1005abab
lea ecx, [esp + 0x50]
call fcn.10022680
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], 0x16
call fcn.10022680
mov ebx, dword [esp + 0x30]
push 0xa4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb0], 0
push 0
push eax
call fcn.1006df00
mov ecx, dword [esp + 0x2c]
lea edi, [esp + 0xb8]
add esp, 8
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x84]
mov edx, edi
mov dword [esi], eax
call fcn.10027530
add esp, 4
test eax, eax
jne 0x1005afba
push ecx
mov ecx, esp
lea edx, [esp + 0x24]
mov esi, edi
lea edi, [esp + 0x84]
push str..exe
call fcn.10022e60
add esp, 4
mov edx, esi
mov ecx, edi
call fcn.10027530
add esp, 4
test eax, eax
jne 0x1005afba
lea ecx, [esp + 0x40]
call fcn.10022b60
mov byte [esp + 0x1c0], 0x2c
mov ecx, 1
mov esi, dword [esp + 0x40]
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x1005acd8
push 0x514
lea ecx, [esp + 0x44]
call fcn.10023670
mov esi, dword [esp + 0x40]
push esi
push 0x514
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ecx
lea ecx, [esp + 0x44]
call fcn.100230b0
push esi
lea eax, [esp + 0x20]
push str.CreateProcessW:_Non_virtual_executable._CurDir_s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x2d
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 0x2c
call fcn.10022680
mov ebx, dword [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ebx, ebx
jne 0x1005ad70
push esi
call edi
cmp eax, 0xffffffff
jne 0x1005ad70
push esi
lea eax, [esp + 0x20]
mov ebx, esi
push str.CreateProcessW:_Special_CurDir_case:_changing_lpCurrentDirectory_to:__s
push eax
mov dword [esp + 0x50], ebx
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x2e
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 0x2c
call fcn.10022680
push 0x1008fa88
lea ecx, [esp + 0x34]
call fcn.10022c70
test ebx, ebx
je 0x1005ae74
cmp word [ebx], 0
je 0x1005ae74
push ebx
call edi
cmp eax, 0xffffffff
jne 0x1005ae74
push ecx
mov ecx, esp
lea esi, [esp + 0xb0]
push ebx
lea edi, [esp + 0x38]
call fcn.10022bb0
mov edx, esi
mov ecx, edi
call fcn.10027530
add esp, 4
test eax, eax
je 0x1005ae5c
mov ebx, dword [esp + 0x30]
push 0
push 0
push 0
push ecx
lea edi, [ebx - 0x10]
mov esi, esp
mov ecx, edi
call fcn.100236e0
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
call fcn.10032290
add esp, 0x10
mov byte [esp + 0x1c0], 0x2f
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x1005ae51
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x1005ae40
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1005ae40
call fcn.100236e0
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x1005ae2e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
add ebx, 0x10
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], ebx
call fcn.10022680
jmp 0x1005ae78
push dword [edx - 0xc]
lea ecx, [esp + 0x34]
push edx
call fcn.10023530
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
call fcn.10022680
jmp 0x1005ae78
push 0x1008fa88
lea ecx, [esp + 0x34]
call fcn.10022c70
mov edx, str.CreateProcessW:_Setting_NewCurrentDirectory__
call fcn.100394f0
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
call fcn.10022b60
push 0x7530
lea eax, [esp + 0x70]
mov byte [esp + 0x1c4], 0x30
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push ecx
mov esi, esp
mov dword [esp + 0x8c], esp
push dword [esp + 0x28]
push dword [esp + 0x34]
push 0x100b10f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._d_s_s_s
push esi
call fcn.1003a800
mov byte [esp + 0x1e8], 0x31
add esp, 0x14
mov ecx, dword [0x100b2ce4]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
mov edx, 1
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1d4], 0x30
lea ecx, [edx + 0x31]
call fcn.10022720
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 0x14
push dword [esp + 0x5c]
push dword [0x100af300]
call esi
push dword [esp + 0x8c]
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
push dword [esp + 0x68]
cmp dword [ebx - 0xc], 0
mov eax, ebx
mov edx, dword [esp + 0x58]
cmove eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x78]
push edx
mov edx, dword [esp + 0x40]
push eax
push dword [esp + 0x54]
mov eax, dword [esp + 0x3c]
or eax, 4
push eax
push dword [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x7c]
push dword [esp + 0x5c]
call fcn.10059ca0
push dword [esp + 0x78]
mov edi, eax
push dword [0x100af300]
mov dword [esp + 0x30], edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [esp + 0x64], eax
test edi, edi
jne 0x1005af94
call esi
cmp eax, 0x2e4
jne 0x1005af94
mov edx, str.ERROR_ELEVATION_REQUIRED__non_virtual_
call fcn.100394f0
lea ecx, [esp + 0x6c]
call fcn.10022680
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x16
call fcn.10022680
mov edi, dword [esp + 0x80]
jmp 0x1005b75e
mov edi, dword [esp + 0x80]
push 0
push 0
push 0
push ecx
lea ecx, [edi - 0x10]
mov esi, esp
call fcn.100236e0
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
call fcn.10032290
add esp, 0x10
mov byte [esp + 0x1c0], 0x1f
mov edx, dword [eax]
mov esi, dword [esp + 0x70]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x1005b048
cmp dword [esi + 0xc], 0
jl 0x1005b03b
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x1005b03b
call fcn.100236e0
mov dword [esp + 0x14], eax
lea edx, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1005b032
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0x10
mov dword [esp + 0x70], eax
jmp 0x1005b048
push dword [edx - 0xc]
lea ecx, [esp + 0x74]
push edx
call fcn.10023530
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 0x16
call fcn.10022680
push dword [esp + 0x5c]
mov dword [esp + 0x3c], 0
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ecx
mov ecx, dword [esp + 0x24]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.100432b0
add esp, 4
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push dword [esp + 0x28]
push str.IsPE64__s__d__OK_d_
push eax
call fcn.1003a800
add esp, 0x14
mov byte [esp + 0x1c0], 0x20
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x14]
call fcn.10022680
push dword [esp + 0x78]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [esp + 0x50]
call fcn.10022b60
mov eax, dword [esp + 0x44]
mov byte [esp + 0x1c0], 0x21
test eax, eax
je 0x1005b0fd
push eax
lea ecx, [esp + 0x54]
call fcn.10022c70
mov esi, dword [esp + 0x50]
jmp 0x1005b13d
mov esi, dword [esp + 0x50]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x1005b127
push 0x514
lea ecx, [esp + 0x54]
call fcn.10023670
mov esi, dword [esp + 0x50]
push esi
push 0x514
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ecx
lea ecx, [esp + 0x54]
call fcn.100230b0
push 0x1008fa88
lea ecx, [esp + 0x44]
call fcn.10022bb0
push 0xa4
lea eax, [esp + 0xb4]
mov byte [esp + 0x1c4], 0x22
push 0
push eax
mov dword [esp + 0xb8], 0
call fcn.1006df00
add esp, 8
lea eax, [esi - 0x10]
mov ecx, eax
mov dword [esp + 0x18], esp
mov dword [esp + 0x28], eax
call fcn.100236e0
mov ecx, esp
lea edx, [esp + 0xb0]
add eax, 0x10
mov dword [ecx], eax
lea ecx, [esp + 0x44]
call fcn.10027530
add esp, 4
test eax, eax
je 0x1005b244
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x50]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
call fcn.10032290
add esp, 0x10
mov byte [esp + 0x1c0], 0x23
lea esi, [ebx - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x1005b23b
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x1005b22a
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x1005b22a
call fcn.100236e0
mov dword [esp + 0x14], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1005b21a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x10]
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x1c]
jmp 0x1005b2c8
push dword [edx - 0xc]
lea ecx, [esp + 0x34]
push edx
call fcn.10023530
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
jmp 0x1005b2c8
lea ecx, [ebx - 0x10]
lea edx, [esi - 0x10]
mov dword [esp + 0x14], ecx
cmp edx, ecx
je 0x1005b2a2
cmp dword [ecx + 0xc], 0
lea ebx, [ecx + 0xc]
jl 0x1005b291
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1005b291
mov ecx, edx
call fcn.100236e0
mov dword [esp + 0x1c], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1005b288
mov esi, dword [esp + 0x14]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 0x10]
mov dword [esp + 0x30], ebx
jmp 0x1005b2a2
push dword [esi - 0xc]
lea ecx, [esp + 0x34]
push esi
call fcn.10023530
mov ebx, dword [esp + 0x30]
push ebx
lea eax, [esp + 0x18]
push str.CreateProcessW:_Setting_NewCurrentDirectory__s___1_
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x24
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], 0x22
call fcn.10022680
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
test ecx, ecx
je 0x1005b346
test eax, 0x400
jne 0x1005b346
xor eax, eax
lea ebx, [ebx]
cmp byte [ecx + eax], 0
jne 0x1005b2fd
cmp byte [ecx + eax + 1], 0
je 0x1005b300
inc eax
jmp 0x1005b2f0
lea eax, [eax*2 + 4]
push eax
call fcn.1006bba0
mov edi, dword [esp + 0x4c]
add esp, 4
mov esi, eax
xor ecx, ecx
mov dl, byte [edi + ecx]
test dl, dl
jne 0x1005b325
cmp byte [edi + ecx + 1], dl
je 0x1005b330
movsx ax, dl
mov word [esi + ecx*2], ax
inc ecx
jmp 0x1005b318
mov edi, dword [esp + 0x80]
xor eax, eax
mov dword [esi + ecx*2], eax
mov ecx, esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], ecx
or eax, 0x400
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x1005b357
mov eax, ecx
jmp 0x1005b35d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push dword [esp + 0x38]
mov esi, dword [esp + 0x74]
lea edx, [esp + 0x88]
push esi
mov ecx, eax
call fcn.10059310
add esp, 8
cmp dword [ebx - 0xc], 0
jne 0x1005b460
push ecx
lea ecx, [esi - 0x10]
mov dword [esp + 0x18], esp
call fcn.100236e0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
mov eax, 0x5c
movzx edx, ax
lea ecx, [esp + 0x80]
call fcn.1003a970
add esp, 4
mov byte [esp + 0x1c0], 0x25
lea ecx, [ebx - 0x10]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
lea edx, [eax - 0x10]
cmp edx, ecx
je 0x1005b41c
cmp dword [ecx + 0xc], 0
lea ebx, [ecx + 0xc]
jl 0x1005b40b
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1005b407
mov ecx, edx
call fcn.100236e0
mov dword [esp + 0x1c], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1005b3fe
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 0x10]
mov dword [esp + 0x30], ebx
jmp 0x1005b41c
mov eax, dword [esp + 0x1c]
push dword [eax - 0xc]
lea ecx, [esp + 0x34]
push eax
call fcn.10023530
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1c0], 0x22
call fcn.10022680
push ebx
lea eax, [esp + 0x18]
push str.CreateProcessW:_Setting_NewCurrentDirectory__s___2_
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x1c0], 0x26
mov edx, dword [eax]
call fcn.100394f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], 0x22
call fcn.10022680
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1005b47c
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0x1c0], 0x27
mov edx, 0x10091170
mov eax, dword [esp + 0x18]
mov ecx, 0x1008fa88
push eax
cmp dword [eax - 0xc], 0
lea eax, [esp + 0x3c]
cmovne ecx, edx
push ecx
push esi
push str.__s__s_s
push eax
call fcn.1003f740
mov esi, dword [esp + 0x4c]
add esp, 0x14
mov eax, dword [esp + 0x70]
push dword [esp + 0x2c]
push dword [esp + 0x64]
push esi
push ebx
push dword [esp + 0x28]
push eax
lea eax, [esp + 0x2c]
push str.CreateProcessW:_Executing_a_virtual_executable._n__VirtFileName__s__n__Arguments__s__n__NewCurrentDirectory__s__n__CmdLine__s__n__SecurityAttributes_x_n__dwCreationFlags0x_x
push eax
call fcn.1003a800
add esp, 0x20
mov byte [esp + 0x1c0], 0x28
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 0x27
or ecx, 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b51a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x8c]
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
push dword [esp + 0x5c]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebx - 0xc], 0
jne 0x1005b562
push 0
lea ecx, [esp + 0x20]
call fcn.10022bb0
mov byte [esp + 0x1c0], 0x29
mov edx, dword [esp + 0x4c]
or edx, 4
mov dword [esp + 0x4c], edx
mov dword [esp + 0x64], edx
jmp 0x1005b58f
lea ecx, [ebx - 0x10]
call fcn.100236e0
add eax, 0x10
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c0], 0x2a
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
or ecx, 8
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
cmp dword [esi - 4], 1
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
jle 0x1005b5af
push dword [esi - 0xc]
lea ecx, [esp + 0x3c]
call fcn.100235f0
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
push dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x30]
push edx
push ecx
push dword [esp + 0x90]
or eax, 4
cmp dword [esp + 0x84], 0xffffffff
push eax
push dword [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x7c]
push esi
push dword [esp + 0x94]
jne 0x1005b5ee
call dword [0x100b109c]
jmp 0x1005b5fb
push dword [esp + 0x9c]
call dword [0x100b10a0]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x4c]
test al, 8
je 0x1005b61b
and eax, 0xfffffff7
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
call fcn.10022680
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c0], 0x27
test al, 4
je 0x1005b633
lea ecx, [esp + 0x1c]
call fcn.10022680
push dword [esp + 0x78]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x64], eax
jne 0x1005b66b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x1005b66b
mov edx, str.ERROR_ELEVATION_REQUIRED__virtual_
call fcn.100394f0
push ecx
lea ecx, [esp + 0x3c]
call fcn.100230b0
push dword [esp + 0x84]
call fcn.1006ac0c
lea edx, [esi - 0x10]
mov byte [esp + 0x1c4], 0x22
or esi, 0xffffffff
lea eax, [edx + 0xc]
add esp, 4
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b6a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 0x21
mov ecx, esi
mov edx, dword [esp + 0x40]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b6cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 0x16
mov ecx, esi
mov edx, dword [esp + 0x24]
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b6ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov eax, str.empty
test ecx, ecx
cmovne eax, ecx
push eax
mov eax, dword [esp + 0x70]
push ecx
push dword [eax + 8]
lea eax, [esp + 0x24]
push dword [esp + 0x74]
push dword [esp + 0x3c]
push str.RetVal_d__le_d__PID_d__lpCurrentDirectory_p_s__lpEnvironment_s
push eax
call fcn.1003a800
add esp, 0x20
mov byte [esp + 0x1c0], 0x2b
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 0x16
mov ecx, esi
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b758
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x28], 0
je 0x1005bae9
push ecx
mov ecx, dword [esp + 0x1c]
mov esi, esp
add ecx, 0xfffffff0
mov dword [esp + 0x18], esp
call fcn.100236e0
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [esp + 0x1c8], 0x32
mov esi, esp
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.100236e0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1c8], 0x16
call fcn.10062a70
mov esi, dword [esp + 0x70]
add esp, 8
mov cl, byte [0x100af304]
mov edx, dword [esi]
test edx, edx
je 0x1005ba88
test cl, cl
je 0x1005ba88
test eax, eax
jne 0x1005ba88
push ecx
mov eax, esp
push str.Injecting_child
push eax
call fcn.1003a800
add esp, 8
call fcn.10021810
mov edx, dword [esi]
xor eax, eax
mov ecx, dword [esp + 0x8c]
add esp, 4
cmp dword [0x100b2cf0], eax
setne al
push eax
push dword [esi + 8]
call fcn.100426c0
add esp, 4
mov dword [esp + 0x40], eax
mov ecx, esp
push eax
push dword [esp + 0x90]
push str.MyInjectLibrary__s__d
push ecx
call fcn.1003a800
add esp, 0x10
call fcn.10021810
mov eax, dword [esp + 0x6c]
mov esi, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x40]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100b10f8
push dword [esp + 0x2c]
push dword [esp + 0x38]
push str.Inject:_Cmd__s___Args__s___Parent__s___d___NewPID_d__Inj_d
push esi
call fcn.1003a800
add esp, 0x1c
mov byte [esp + 0x1c8], 0x33
mov ecx, esp
push str.CreateProcess
call fcn.10022bb0
xor ecx, ecx
mov byte [esp + 0x1c8], 0x16
call fcn.10039770
add esp, 8
cmp dword [esp + 0x3c], 0
jne 0x1005b8f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov ecx, dword [esp + 0x28]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x1c]
mov dword [esi], eax
mov eax, 0x5c
movzx edx, ax
call fcn.1003a890
add esp, 4
push dword [eax]
mov eax, dword [esp + 0x70]
push dword [eax + 8]
lea eax, [esp + 0xb8]
push str.Could_not_inject_process__d___s___LE_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [esp + 0x14]
call fcn.10022680
push 0
push str.InjectLibrary_Error
lea eax, [esp + 0xb4]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [esp + 0x28]
push dword [esp + 0x94]
push dword [0x100af300]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esp + 0x1c0], 0x15
or ecx, 0xffffffff
mov edx, dword [esp + 0x70]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b940
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [edi - 0x10]
mov byte [esp + 0x1c0], 0x14
or edi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b964
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 7
mov ecx, edi
mov edx, dword [esp + 0x90]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b98c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 6
mov ecx, edi
mov edx, dword [esp + 0x98]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b9b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 5
mov ecx, edi
mov edx, dword [esp + 0x88]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005b9dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1c0], 4
mov ecx, edi
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005ba01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [esp + 0x1c0], 3
mov ecx, edi
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005ba22
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x1c0], 0xffffffff
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1005ba48
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x1005ba60
test byte [esp + 0x2c], 4
jne 0x1005ba60
mov eax, dword [esp + 0x68]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.1006abfd
mov esp, ebp
pop ebp
ret 0x2c
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push eax
movzx eax, cl
push eax
mov eax, dword [esp + 0x74]
push dword [eax + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100b10f8
push dword [esp + 0x34]
push dword [esp + 0x40]
push str.NoInject:_Cmd__s___Args__s___Parent__s___d___hProcess_x__d___ChildInj_d__StopInherit_d
push esi
call fcn.1003a800
mov byte [esp + 0x1ec], 0x34
add esp, 0x24
mov ecx, esp
push str.CreateProcess
call fcn.10022bb0
xor ecx, ecx
mov byte [esp + 0x1c8], 0x16
call fcn.10039770
add esp, 8
jmp 0x1005b8f9
call esi
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100b10f8
push dword [esp + 0x28]
push dword [esp + 0x34]
push str.Failed:_Cmd__s___Args__s___Parent__s___d___LE_d
push esi
call fcn.1003a800
mov byte [esp + 0x1e0], 0x35
add esp, 0x18
jmp 0x1005bac6
lea eax, [esp + 0x14]
push str.SANDBOXFLAGS_STRICTLY_ISOLATED____denying_
push eax
call fcn.1003a800
add esp, 8
mov byte [esp + 0x1c0], 0x17
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x1c0], 0x16
or ecx, 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1005bb66
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x64], 5
xor esi, esi
jmp 0x1005b8fd