Function at 0x10001864
Capabilities:
Enumerate process modules
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x10023b14
mov eax, dword fs:[0]
push eax
mov eax, 0x2054
call fcn.10010da0
mov eax, dword [0x1002eab0]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0x110]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x100018c4
inc eax
jmp 0x10001ad1
lea ecx, [ebp - 0x20]
push ecx
push 0x2000
lea ecx, [ebp - 0x2060]
push ecx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10001ac6
and dword [ebp - 0x1c], 0
test dword [ebp - 0x20], 0xfffffffc
jbe 0x10001ac6
mov ebx, 0x10035010
mov esi, str.UNKNOW
lea edi, [ebp]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xfd
lea eax, [ebp + 7]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.10010110
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
mov eax, dword [ebp - 0x1c]
push dword [ebp + eax*4 - 0x2060]
push dword [ebp - 0x28]
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x10001ab4
call fcn.10002cee
push eax
lea ecx, [ebp - 0x14]
call fcn.10001be0
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x10031378
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push 0x1002908c
push eax
call fcn.10001d43
add esp, 0xc
lea edi, [ebp - 0x14]
call fcn.10001bb3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x44]
call fcn.100013bf
mov esi, eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 1
push dword [eax]
lea ecx, [ebp - 0x60]
call fcn.100013bf
cmp dword [esi + 0x18], 0x10
mov edi, dword [esi + 0x14]
mov dword [ebp - 0x24], edi
jb 0x1000199f
mov esi, dword [esi + 4]
jmp 0x100019a2
add esi, 4
mov edx, dword [eax + 0x14]
mov ecx, edx
cmp ecx, edx
jae 0x100019ab
mov ecx, edx
cmp edx, edi
jb 0x100019b3
mov ecx, edi
cmp dword [eax + 0x18], 0x10
jb 0x100019be
mov eax, dword [eax + 4]
jmp 0x100019c1
add eax, 4
mov edi, esi
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100019d0
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
jne 0x100019ea
cmp edx, dword [ebp - 0x24]
jae 0x100019e0
or eax, 0xffffffff
jmp 0x100019e8
xor eax, eax
cmp edx, dword [ebp - 0x24]
setne al
cmp eax, esi
push esi
push 1
lea ecx, [ebp - 0x60]
sete byte [ebp - 0xd]
call fcn.100014c6
push esi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.100014c6
cmp byte [ebp - 0xd], 0
je 0x10001a94
push 0x64
push esi
push ebx
call fcn.10010110
mov eax, dword [ebp - 0x14]
mov edx, ebx
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10001a25
jmp 0x10001a39
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10033f9c], esi
jbe 0x10001a31
mov edi, dword [sym.imp.WS2_32.dll_send]
push esi
push 0x64
push ebx
push dword [0x10033f9c]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0
push 0x64
push ebx
push dword [0x10033fa4]
call edi
push 0x7d0
call esi
push dword [0x10033f9c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push str.Pinkof_AntiHack
push str.Hack_Detected
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add dword [ebp - 0x18], 4
cmp dword [ebp - 0x18], 0x100313fc
jl 0x10001953
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.1000184a
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x1c]
shr eax, 2
cmp dword [ebp - 0x1c], eax
jb 0x100018f8
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.1000ce7f
add ebp, 0x108
leave
ret