Function at 0x1002739a
Capabilities:
Resume thread

Disassembly:
mov eax, 0x10135490
call fcn.1007db34
sub esp, 0x64c
push ebx
push esi
lea eax, [ebp - 0x40]
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ecx
push eax
mov dword [ebp - 0x40], ebx
call fcn.100011ce
test eax, eax
pop ecx
je 0x100274a8
test byte [ebp - 0x40], 1
je 0x100274a8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, ebx
je 0x10027452
push dword [ebp + 0x34]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
push dword [ebp + 0x30]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ebx
jmp 0x100274a0
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x100274a0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x100274a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x14]
jmp 0x10027b71
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x26e]
mov word [ebp - 0x270], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x2c]
xor edi, edi
cmp eax, ebx
mov dword [ebp - 0x14], ebx
je 0x1002751d
cmp word [eax + 0x38], bx
jbe 0x1002751d
push 0x103
push dword [eax + 0x3c]
lea eax, [ebp - 0x270]
push eax
call fcn.1007e246
add esp, 0xc
cmp dword [0x101b04b8], ebx
lea eax, [ebp - 0x270]
push 1
mov dword [ebp - 0x14], eax
pop edi
je 0x1002751d
lea eax, [ebp - 0x270]
push eax
push 0x319
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__AppName__s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x14
push 4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], ebx
call fcn.1005eb25
push dword [ebp - 0x14]
mov esi, 0x101ad1f8
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.1004dc16
test eax, eax
jne 0x10027580
call fcn.100511e1
test eax, eax
jne 0x10027557
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x10027580
mov ecx, esi
call fcn.1004dc65
test eax, eax
jne 0x10027580
cmp edi, ebx
je 0x10027579
lea eax, [ebp - 0x270]
mov ecx, esi
push eax
call fcn.1004f0fe
mov dword [ebp - 0x10], eax
jmp 0x10027580
mov dword [ebp - 0x10], 2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1005eb48
cmp dword [ebp - 0x10], ebx
push 1
jne 0x10027687
pop esi
lea ecx, [ebp - 0x38]
push esi
call fcn.10001261
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x10], ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, ebx
je 0x10027625
push dword [ebp + 0x34]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
push dword [ebp + 0x30]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ebx
jmp 0x10027673
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x10027673
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10027673
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov esi, dword [esi + 0x14]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.1000127e
jmp 0x10027b6f
lea ecx, [ebp - 0x44]
call fcn.10001261
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov ebx, dword [esi + 0x20]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
test eax, eax
je 0x10027719
push dword [ebp + 0x34]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x24]
push dword [ebp + 0x30]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x20], eax
push dword [ebp + 0x2c]
mov dword [esi + 0x24], ecx
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x20], ebx
mov dword [esi + 0xc], eax
jmp 0x10027767
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10027767
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10027767
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov esi, dword [esi + 0x14]
push 4
lea ecx, [ebp - 0x50]
mov dword [ebp + 0x30], esi
call fcn.1005eb25
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x30]
mov dword [ebp - 0x34], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 3
stosd dword es:[edi], eax
call fcn.1005b974
test eax, eax
je 0x100277c1
xor eax, eax
lea edi, [ebp - 0x64]
mov dword [ebp - 0x68], ebx
mov dword [ebp + 0x2c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x68]
push 0x18
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax]
call dword [0x101aec64]
cmp eax, ebx
jne 0x100277c1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
cmp dword [0x101b04b8], ebx
je 0x100277e6
push dword [ebp - 0x2c]
push esi
push 0x37b
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__statusRet__08x__PID__08x_
push str.SafeInject
push 1
call fcn.1007bb15
add esp, 0x18
cmp esi, ebx
jne 0x10027b54
cmp dword [ebp - 0x2c], ebx
je 0x10027b54
lea eax, [ebp - 0x270]
mov esi, 0x101ad1f8
push eax
mov ecx, esi
call fcn.10050190
test eax, eax
jne 0x10027872
mov ecx, esi
call fcn.1004ed3e
test eax, eax
jne 0x1002783e
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x10027872
lea eax, [ebp - 0x270]
push str.ReaderHostU.exe
push eax
call fcn.1007edba
pop ecx
test eax, eax
pop ecx
je 0x10027872
push ebx
push 1
push dword [ebp - 0x2c]
call fcn.10052dd3
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.1007c2fd
lea eax, [ebp - 0x2c]
push 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.1007d10b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.1007c326
push dword [ebp - 0x2c]
lea eax, [ebp - 0x270]
mov ecx, esi
push eax
call fcn.1004cf1a
test eax, eax
je 0x100278d8
lea ecx, [ebp - 0x1c]
call fcn.1007c2fd
lea eax, [ebp - 0x2c]
push 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.1007d10b
cmp dword [0x101b04b8], ebx
je 0x100278cc
push dword [ebp - 0x2c]
lea eax, [ebp - 0x270]
push eax
push 0x38d
push str._CSafeInject::OnNtCreateUserProcess__Line:_d_FileDevice_Allow_it...Proc__s__PID__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x18
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.1007c326
lea eax, [ebp + 0x34]
mov dword [ebp + 0x34], ebx
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
call fcn.10027369
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x2c], eax
jne 0x100278fa
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x2c], eax
push dword [ebp + 0x2c]
mov esi, 0x101aad04
call fcn.100ab010
test eax, eax
pop ecx
je 0x10027917
cmp dword [ebp - 0x10], 4
je 0x1002791d
mov dword [ebp - 0x10], ebx
jmp 0x1002791d
mov esi, dword [0x101ad644]
push esi
lea ecx, [ebp + 0xc]
call fcn.100943c0
mov eax, dword [eax]
push ebx
push eax
mov byte [ebp - 4], 6
call fcn.1007344b
mov ebx, eax
pop ecx
neg ebx
pop ecx
mov byte [ebp - 4], 3
sbb bl, bl
lea ecx, [ebp + 0xc]
inc bl
call fcn.10094cc0
test bl, bl
je 0x10027951
xor ebx, ebx
jmp 0x10027954
mov ebx, dword [ebp - 0x10]
xor edi, edi
call fcn.100bc6f0
test eax, eax
je 0x1002796a
push str.tsysdrv.dll
call fcn.100d6050
pop ecx
cmp ebx, 1
jne 0x1002797d
push esi
push dword [ebp - 0x30]
push dword [ebp + 0x2c]
call fcn.100d7160
jmp 0x100279ac
cmp ebx, 2
je 0x10027998
cmp ebx, 4
jne 0x1002799c
push esi
push dword [ebp - 0x2c]
call fcn.10059a8e
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x100279b1
push 0
jmp 0x100279a3
cmp ebx, 3
jne 0x100279b1
push 1
push esi
push dword [ebp + 0x2c]
call fcn.100d7370
add esp, 0xc
mov edi, eax
cmp dword [0x101b04b8], 0
je 0x100279e6
lea eax, [ebp - 0x270]
push eax
push edi
mov edi, 0x101ad158
push ebx
mov ecx, edi
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnNtCreateUserProcess___Type:_d__Inject__d____s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x100279eb
mov edi, 0x101ad158
mov ecx, edi
call fcn.10057df6
test eax, eax
je 0x10027b36
cmp dword [ebp - 0x14], 0
je 0x10027b36
push dword [ebp - 0x14]
call fcn.10057a13
cmp eax, 0x310
pop ecx
jne 0x10027b36
mov ecx, edi
call fcn.100aa440
push eax
lea ecx, [ebp + 0xc]
call fcn.10094520
mov eax, dword [0x101b04b8]
xor esi, esi
cmp eax, esi
mov byte [ebp - 4], 7
mov ebx, str.SafeDoc
je 0x10027a54
push dword [ebp + 0xc]
push 0x3ea
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
mov edx, dword [ebp + 0xc]
cmp dword [edx - 8], esi
je 0x10027b2a
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
mov ecx, 0xf9
stosd dword es:[edi], eax
lea edi, [ebp - 0x656]
mov word [ebp - 0x658], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1f3
lea eax, [ebp - 0x658]
push edx
push eax
call fcn.1007e246
lea eax, [ebp - 0x1c]
push 2
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.100271ef
add esp, 0x18
cmp eax, 2
jne 0x10027b0c
cmp dword [0x101b04b8], esi
je 0x10027ace
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x3fc
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__Cmd1__s___Cmd2__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x18
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
call fcn.1002c5b0
mov edi, eax
push edi
push dword [ebp - 0x2c]
call fcn.1000a24d
cmp dword [0x101b04b8], esi
pop ecx
pop ecx
je 0x10027b2a
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push edi
push 0x403
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__Enable__d__PID__d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x10027b2a
cmp dword [0x101b04b8], esi
je 0x10027b2a
push eax
push 0x3f7
push str._CSafeInject::OnNtCreateUserProcess__Line:_d__iCount__d_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.10094cc0
cmp dword [ebp + 0x34], 0
je 0x10027b45
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 0x24], 4
jne 0x10027b54
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.1005eb48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1000127e
mov esi, dword [ebp + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x30