Function at 0x4156e0
Capabilities:
Check mutex on windows
Connect pipe
Create pipe
Create thread
Execute anti-debugging instructions
Get system information on windows
Query or enumerate registry value
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d1ee
mov eax, dword fs:[0]
push eax
mov eax, 0x24e0
call fcn.0042c2e0
mov eax, dword [0x4b0040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x22ec], esi
call fcn.00418830
push 8
mov dword [eax], vtable.BaseTestingRTTI.0
mov dword [sym.Detours.exe_class_BaseTestingRTTI__g_pBaseTestingRTTI], eax
call fcn.00418830
mov edi, dword [ebp + 8]
add esp, 8
mov dword [ebp - 0x2494], eax
mov dword [eax], vtable.TestingRTTI.0
mov word [eax + 4], 1
mov dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI], eax
cmp edi, 1
jle 0x416a38
xor eax, eax
mov dword [ebp - 0x22e4], eax
lea eax, [esi + eax*4]
mov edx, str._test_scan
mov dword [ebp - 0x2488], eax
mov eax, dword [eax]
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x41579a
test si, si
je 0x415796
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x41579a
add ecx, 4
add edx, 4
test si, si
jne 0x415774
xor ecx, ecx
jmp 0x41579f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x416a10
mov edx, str._benchmark_scan
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x4157d6
test si, si
je 0x4157d2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4157d6
add ecx, 4
add edx, 4
test si, si
jne 0x4157b0
xor ecx, ecx
jmp 0x4157db
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x416a06
mov edx, str._event_server
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x415816
test si, si
je 0x415812
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415816
add ecx, 4
add edx, 4
test si, si
jne 0x4157f0
xor ecx, ecx
jmp 0x41581b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x4168cc
cmp edi, 2
jle 0x415863
mov edx, str._event_client
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x415856
test si, si
je 0x415852
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415856
add ecx, 4
add edx, 4
test si, si
jne 0x415830
xor ecx, ecx
jmp 0x41585b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x415a83
mov edx, str._mutex_server
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x415896
test si, si
je 0x415892
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415896
add ecx, 4
add edx, 4
test si, si
jne 0x415870
xor ecx, ecx
jmp 0x41589b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x41675a
cmp edi, 2
jle 0x4158e3
mov edx, str._mutex_client
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x4158d6
test si, si
je 0x4158d2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4158d6
add ecx, 4
add edx, 4
test si, si
jne 0x4158b0
xor ecx, ecx
jmp 0x4158db
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x415b41
mov edx, str._semaphore_server
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x415916
test si, si
je 0x415912
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415916
add ecx, 4
add edx, 4
test si, si
jne 0x4158f0
xor ecx, ecx
jmp 0x41591b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x4165db
cmp edi, 2
jle 0x415963
mov edx, str._semaphore_client
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x415956
test si, si
je 0x415952
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415956
add ecx, 4
add edx, 4
test si, si
jne 0x415930
xor ecx, ecx
jmp 0x41595b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x415c33
mov edx, str._pipe_server
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x415996
test si, si
je 0x415992
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415996
add ecx, 4
add edx, 4
test si, si
jne 0x415970
xor ecx, ecx
jmp 0x41599b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x4161c7
cmp edi, 2
jle 0x4159e3
mov edx, str._pipe_client
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x4159d6
test si, si
je 0x4159d2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4159d6
add ecx, 4
add edx, 4
test si, si
jne 0x4159b0
xor ecx, ecx
jmp 0x4159db
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x415d05
mov edx, str._shared_server
mov ecx, eax
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x415a16
test si, si
je 0x415a12
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x415a16
add ecx, 4
add edx, 4
test si, si
jne 0x4159f0
xor ecx, ecx
jmp 0x415a1b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x415f92
cmp edi, 2
jle 0x415a63
mov ecx, str._shared_client
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415a56
test dx, dx
je 0x415a52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415a56
add eax, 4
add ecx, 4
test dx, dx
jne 0x415a30
xor eax, eax
jmp 0x415a5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x415e71
mov eax, dword [ebp - 0x22e4]
inc eax
mov dword [ebp - 0x22e4], eax
cmp eax, edi
jge 0x416a38
mov esi, dword [ebp - 0x22ec]
jmp 0x415762
mov edi, dword [ebp - 0x2488]
mov edi, dword [edi + 4]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415a91
sub ecx, edx
sar ecx, 1
cmp ecx, 0x28
jne 0x415c14
push edi
push str.Connecting_to___s__n
call fcn.0040dc00
add esp, 8
xor esi, esi
test edi, edi
je 0x415c04
push 0x80
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00419c70
push edi
lea eax, [ebp - 0xa0]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x415c04
lea eax, [ebp - 0xa0]
push eax
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x415c14
cmp esi, 0xffffffff
je 0x415c04
push esi
call dword [sym.imp.KERNEL32.dll_PulseEvent]
test eax, eax
je 0x415c0d
push str.Signaled_n
call fcn.0040dc00
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x415c17
mov edi, dword [ebp - 0x2488]
mov edi, dword [edi + 4]
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415b50
sub ecx, edx
sar ecx, 1
cmp ecx, 0x28
jne 0x415c14
push edi
push str.Connecting_to___s__n
call fcn.0040dc00
add esp, 8
xor esi, esi
test edi, edi
je 0x415c04
push 0x80
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00419c70
push edi
lea eax, [ebp - 0xa0]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x415c04
lea eax, [ebp - 0xa0]
push eax
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
je 0x415c14
cmp esi, 0xffffffff
je 0x415c04
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x415c0d
push str.Locked_n
call fcn.0040dc00
add esp, 4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x415c0d
push str.UnLocked_n
jmp 0x415b2b
test esi, esi
je 0x415c14
cmp esi, 0xffffffff
je 0x415c14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041881d
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x2488]
mov edi, dword [edi + 4]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415c41
sub ecx, edx
sar ecx, 1
cmp ecx, 0x2c
jne 0x415c14
push edi
push str.Connecting_to___s__n
call fcn.0040dc00
add esp, 8
xor esi, esi
test edi, edi
je 0x415c04
push 0x80
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00419c70
push edi
lea eax, [ebp - 0xa0]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x415c04
lea eax, [ebp - 0xa0]
push eax
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
je 0x415c14
cmp esi, 0xffffffff
je 0x415c04
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x415c0d
push str.Entered_n
call fcn.0040dc00
add esp, 4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x415c0d
push str.Leaved_n
jmp 0x415b2b
mov edi, dword [ebp - 0x2488]
mov esi, dword [edi + 4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415d13
sub ecx, edx
sar ecx, 1
cmp ecx, 0x27
jne 0x415c14
push esi
push str.Connecting_to___s__n
call fcn.0040dc00
add esp, 8
mov dword [ebp - 0x22f8], 0x1000
mov dword [ebp - 0x22f4], 0
test esi, esi
je 0x415c14
push 0x80
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00419c70
push esi
lea eax, [ebp - 0xa0]
push str..pipe_s
push eax
call fcn.0040be60
add esp, 0x18
lea eax, [ebp - 0xa0]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x22f4], esi
test esi, esi
je 0x415c14
cmp esi, 0xffffffff
je 0x415c14
push 0x1000
lea eax, [ebp - 0x22e0]
push 0
push eax
call fcn.00419c70
add esp, 0xc
mov dword [ebp - 0x22e4], 0
lea eax, [ebp - 0x22e4]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x22e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415dfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jmp 0x415e07
cmp dword [ebp - 0x22e4], 0x1000
jne 0x415c0d
cmp byte [ebp - 0x22e0], 1
jne 0x415e61
lea eax, [ebp - 0x22e0]
mov byte [ebp - 0x22e0], 0
push eax
lea ecx, [ebp - 0x22f8]
call fcn.00403810
test al, al
je 0x415e61
push str.Send_0_n
call fcn.0040dc00
add esp, 4
lea ecx, [ebp - 0x22f8]
call fcn.004037e0
test al, al
je 0x415e61
lea ecx, [ebp - 0x22f8]
call fcn.004037b0
xor eax, eax
jmp 0x415c17
lea ecx, [ebp - 0x22f8]
call fcn.004037b0
jmp 0x415c14
mov edi, dword [ebp - 0x2488]
mov edi, dword [edi + 4]
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415e80
sub ecx, edx
sar ecx, 1
cmp ecx, 0x29
jne 0x415c14
push edi
push str.Connecting_to___s__n
call fcn.0040dc00
xorps xmm0, xmm0
xor esi, esi
add esp, 8
movlpd qword [ebp - 0x22f8], xmm0
mov dword [ebp - 0x22f4], esi
test edi, edi
je 0x415f24
push 0x80
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00419c70
push edi
lea eax, [ebp - 0xa0]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x415f24
lea eax, [ebp - 0xa0]
push eax
push esi
push 0x26
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x22f8], eax
test eax, eax
je 0x415f1e
cmp eax, 0xffffffff
je 0x415f1e
push esi
push esi
push esi
push 0x26
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x22f4], esi
jmp 0x415f24
mov dword [ebp - 0x22f8], esi
test esi, esi
jne 0x415f38
lea ecx, [ebp - 0x22f8]
call fcn.00403a70
jmp 0x415c14
push esi
push str.Memory:_0x_08X_n
call fcn.0040dc00
mov eax, dword [esi + 4]
add esp, 8
lea edi, [eax + 0x1388]
cmp eax, edi
jae 0x415f70
push eax
push str.Tick:__lu_n
call fcn.0040dc00
add esp, 8
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 4]
cmp eax, edi
jb 0x415f53
push str.Stopped_n
mov byte [esi], 1
call fcn.0040dc00
add esp, 4
lea ecx, [ebp - 0x22f8]
call fcn.00403a70
xor eax, eax
jmp 0x415c17
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0x80
mov esi, eax
lea eax, [ebp - 0x23ac]
push 0
push eax
call fcn.00419c70
xor eax, eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x232c], ecx
mov dword [ebp - 0x2488], eax
mov dword [ebp - 0x2328], eax
test esi, esi
je 0x4160c9
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x4160b7
rdtsc
push edx
push eax
mov eax, dword [ecx + 0x24]
not eax
push eax
mov eax, dword [ecx + 0x20]
not eax
push eax
lea eax, [ebp - 0x23ac]
push str.SHARED:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x4160a1
push 0x80
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x23ac]
push eax
lea eax, [ebp - 0xa0]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x4160a1
lea eax, [ebp - 0xa0]
push eax
push esi
push 0
push 0x40
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x232c], eax
test eax, eax
je 0x416079
cmp eax, 0xffffffff
je 0x416079
push 0
push 0
push 0
push 0x26
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2328], eax
jmp 0x4160bd
push 0x80
lea eax, [ebp - 0x23ac]
push 0
push eax
call fcn.00419c70
xor ecx, ecx
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x232c], ecx
mov dword [ebp - 0x2328], eax
jmp 0x4160c3
push 0x80
lea eax, [ebp - 0x23ac]
push 0
push eax
call fcn.00419c70
add esp, 0xc
mov eax, dword [ebp - 0x2328]
mov ecx, dword [ebp - 0x232c]
mov dword [ebp - 0x2488], eax
test eax, eax
jne 0x4160e4
test ecx, ecx
je 0x415c14
cmp ecx, 0xffffffff
je 0x415c14
push ecx
jmp 0x415c0e
push eax
push str.Memory:_0x_08X_n
call fcn.0040dc00
mov eax, dword [ebp - 0x232c]
add esp, 8
test eax, eax
je 0x416199
cmp eax, 0xffffffff
je 0x416199
lea eax, [ebp - 0x120]
mov ecx, 0x20
push eax
lea esi, [ebp - 0x23ac]
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
push str.SharedServer:__s_n
call fcn.0040dc00
mov esi, dword [ebp - 0x2488]
add esp, 8
cmp byte [esi], 0
jne 0x416156
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 1
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi], 0
je 0x416140
push str.Stopped_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2328]
add esp, 4
test eax, eax
je 0x416174
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x232c]
test eax, eax
je 0x415b3a
cmp eax, 0xffffffff
je 0x415b3a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x415c17
mov ecx, dword [ebp - 0x2328]
test ecx, ecx
je 0x4161b0
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x232c]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x415c14
push eax
jmp 0x415c0e
push 0x80
lea eax, [ebp - 0x23a8]
push 0
push eax
call fcn.00419c70
push 0x80
lea eax, [ebp - 0x23a8]
mov dword [ebp - 0x23ac], 0x1000
push 0
push eax
call fcn.00419c70
mov ecx, dword fs:[0x18]
add esp, 0x18
mov dword [ebp - 0x2328], 0
test ecx, ecx
je 0x4162ae
rdtsc
push edx
push eax
mov eax, dword [ecx + 0x24]
not eax
push eax
mov eax, dword [ecx + 0x20]
not eax
push eax
lea eax, [ebp - 0x23a8]
push str.PIPE:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416298
push 0x80
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x23a8]
push eax
lea eax, [ebp - 0xa0]
push str..pipe_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416298
push 0
push 0
push 0x1000
push 0x1000
push 1
push 6
push 3
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x2328], eax
jmp 0x4162ae
push 0x80
lea eax, [ebp - 0x23a8]
push 0
push eax
call fcn.00419c70
add esp, 0xc
lea eax, [ebp - 0x245c]
mov ecx, 0x20
push eax
lea esi, [ebp - 0x23a8]
lea edi, [ebp - 0x245c]
rep movsd dword es:[edi], dword [esi]
push str.PipeServer:__s_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2328]
add esp, 8
test eax, eax
je 0x4162e4
cmp eax, 0xffffffff
jne 0x416351
push 0x80
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x23a8]
push eax
lea eax, [ebp - 0x120]
push str..pipe_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x4164d1
mov eax, dword [ebp - 0x23ac]
push 0
push 0
push eax
push eax
push 1
push 6
push 3
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x2328], eax
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4164ed
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4164e7
push 0xfff
lea eax, [ebp - 0x12df]
push 0
push eax
call fcn.00419c70
mov eax, dword [ebp - 0x2328]
add esp, 0xc
mov byte [ebp - 0x12e0], 1
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4164ed
push 0
lea ecx, [ebp - 0x22e4]
mov dword [ebp - 0x22e4], 0
push ecx
push dword [ebp - 0x23ac]
lea ecx, [ebp - 0x12e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4163da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x4164e7
mov ecx, dword [ebp - 0x23ac]
jmp 0x4163ec
mov ecx, dword [ebp - 0x23ac]
cmp dword [ebp - 0x22e4], ecx
jne 0x4164e7
mov eax, dword [ebp - 0x2328]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4164ed
push 0
lea edx, [ebp - 0x22e4]
mov dword [ebp - 0x22e4], 0
push edx
push ecx
lea ecx, [ebp - 0x12e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416434
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jmp 0x416440
mov eax, dword [ebp - 0x22e4]
cmp eax, dword [ebp - 0x23ac]
jne 0x4164e7
cmp byte [ebp - 0x12e0], 0
jne 0x41645c
push str.Received_0_n
call fcn.0040dc00
add esp, 4
mov eax, dword [ebp - 0x2328]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4164ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4164e7
push 0x80
lea eax, [ebp - 0x23a8]
mov dword [ebp - 0x2328], 0
push 0
push eax
call fcn.00419c70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
not esi
rdtsc
push edx
push eax
not ecx
lea eax, [ebp - 0x23a8]
push ecx
push esi
push str.PIPE:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
jne 0x416560
push 0x80
lea eax, [ebp - 0x23a8]
push 0
push eax
call fcn.00419c70
add esp, 0xc
mov eax, dword [ebp - 0x2328]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x415c14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x415c14
push 0x80
lea eax, [ebp - 0x23a8]
mov dword [ebp - 0x2328], 0
push 0
push eax
call fcn.00419c70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
not esi
rdtsc
push edx
push eax
not ecx
lea eax, [ebp - 0x23a8]
push ecx
push esi
push str.PIPE:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
jmp 0x415c14
mov eax, dword [ebp - 0x2328]
test eax, eax
je 0x415b3a
cmp eax, 0xffffffff
je 0x415b3a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x415b3a
push 0x80
lea eax, [ebp - 0x23a8]
mov dword [ebp - 0x2328], 0
push 0
push eax
call fcn.00419c70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
not esi
rdtsc
push edx
push eax
not ecx
lea eax, [ebp - 0x23a8]
push ecx
push esi
push str.PIPE:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
xor eax, eax
jmp 0x415c17
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov ecx, dword fs:[0x18]
add esp, 0xc
mov dword [ebp - 0x23e0], 0
test ecx, ecx
je 0x41674f
rdtsc
push edx
push eax
mov eax, dword [ecx + 0x24]
not eax
push eax
mov eax, dword [ecx + 0x20]
not eax
push eax
lea eax, [ebp - 0x2460]
push str.SEMAPHORE:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416681
push 0x80
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x2460]
push eax
lea eax, [ebp - 0x120]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416681
lea eax, [ebp - 0x120]
push eax
push 2
push 2
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebp - 0x23e0], eax
jmp 0x41669d
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov eax, dword [ebp - 0x23e0]
add esp, 0xc
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
lea eax, [ebp - 0x1e0]
mov ecx, 0x20
push eax
lea esi, [ebp - 0x2460]
lea edi, [ebp - 0x1e0]
rep movsd dword es:[edi], dword [esi]
push str.SemaphoreServer:__s_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 8
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41674f
push str.Entered_n
call fcn.0040dc00
add esp, 4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x23e0]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x41674f
push str.Leaved_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 4
jmp 0x41617a
mov eax, dword [ebp - 0x23e0]
jmp 0x4161b0
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov ecx, dword fs:[0x18]
add esp, 0xc
mov dword [ebp - 0x23e0], 0
test ecx, ecx
je 0x41674f
rdtsc
push edx
push eax
mov eax, dword [ecx + 0x24]
not eax
push eax
mov eax, dword [ecx + 0x20]
not eax
push eax
lea eax, [ebp - 0x2460]
push str.MUTEX:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x4167fa
push 0x80
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x2460]
push eax
lea eax, [ebp - 0x120]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x4167fa
lea eax, [ebp - 0x120]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x23e0], eax
jmp 0x416816
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov eax, dword [ebp - 0x23e0]
add esp, 0xc
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
lea eax, [ebp - 0x260]
mov ecx, 0x20
push eax
lea esi, [ebp - 0x2460]
lea edi, [ebp - 0x260]
rep movsd dword es:[edi], dword [esi]
push str.MutexServer:__s_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 8
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41674f
push str.Locked_n
call fcn.0040dc00
add esp, 4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x23e0]
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x41674f
push str.UnLocked_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 4
jmp 0x41617a
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov ecx, dword fs:[0x18]
add esp, 0xc
mov dword [ebp - 0x23e0], 0
test ecx, ecx
je 0x41674f
rdtsc
push edx
push eax
mov eax, dword [ecx + 0x24]
not eax
push eax
mov eax, dword [ecx + 0x20]
not eax
push eax
lea eax, [ebp - 0x2460]
push str.EVENT:_08X:_08X:_08X_08X
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416972
push 0x80
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00419c70
lea eax, [ebp - 0x2460]
push eax
lea eax, [ebp - 0x120]
push str.Local_s
push eax
call fcn.0040be60
add esp, 0x18
cmp eax, 0xffffffff
je 0x416972
lea eax, [ebp - 0x120]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x23e0], eax
jmp 0x41698e
push 0x80
lea eax, [ebp - 0x2460]
push 0
push eax
call fcn.00419c70
mov eax, dword [ebp - 0x23e0]
add esp, 0xc
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
lea eax, [ebp - 0x2e0]
mov ecx, 0x20
push eax
lea esi, [ebp - 0x2460]
lea edi, [ebp - 0x2e0]
rep movsd dword es:[edi], dword [esi]
push str.EventServer:__s_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 8
test eax, eax
je 0x415c14
cmp eax, 0xffffffff
je 0x4161b0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41674f
push str.Signaled_n
call fcn.0040dc00
mov eax, dword [ebp - 0x23e0]
add esp, 4
jmp 0x41617a
call fcn.004142c0
jmp 0x415c17
push str.FindSignature_Test_n
call fcn.0040dc00
call fcn.0040dcd0
push str.FindData_Test_n
call fcn.0040dc00
add esp, 8
call fcn.00411520
xor eax, eax
jmp 0x415c17
push str.Kernel_User_Shared_Data_Example_n_n
call fcn.0040dc00
mov eax, dword [0x4b0930]
mov eax, dword [eax + 0x308]
push eax
push str.SystemCall__0x_08X_n
call fcn.0040dc00
mov eax, dword [0x4b0930]
mov eax, dword [eax + 0x330]
push eax
push str.Cookie__0x_08X_n
call fcn.0040dc00
mov eax, dword [0x4b0930]
mov esi, dword [eax + 0x14]
push esi
push str.SystemTime___lu_n
call fcn.0040dc00
push str.Sleeping_1200_ms..._n
call fcn.0040dc00
add esp, 0x20
push 0x4b0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4b0930]
mov ecx, dword [eax + 0x14]
mov eax, 0xd1b71759
sub ecx, esi
mul ecx
shr edx, 0xd
push edx
push str.ElapsedTime___lu_ms_n
call fcn.0040dc00
mov eax, dword [0x4b0930]
mov eax, dword [eax + 0x2f0]
shr eax, 7
and eax, 1
push eax
push str.DbgSecureBootEnabled___lu_n
call fcn.0040dc00
mov eax, dword [0x4b0930]
mov eax, dword [eax + 0x3c0]
push eax
push str.ActiveProcessorCount___lu_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.PEB__TEB_Example_n_n
call fcn.0040dc00
mov edi, dword fs:[0x30]
add esp, 0x20
test edi, edi
je 0x415c14
mov esi, dword fs:[0x18]
test esi, esi
je 0x415c14
lea eax, [ebp - 0x2488]
mov dword [ebp - 0x2488], 0
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x416b48
xor eax, eax
jmp 0x416ba4
mov eax, dword [ebp - 0x2488]
test eax, eax
je 0x416ba4
lea ecx, [ebp - 0x22ec]
mov dword [ebp - 0x22e4], 0
push ecx
lea ecx, [ebp - 0x22e4]
mov dword [ebp - 0x22ec], 4
push ecx
push 0
push 0
push 0x4aadac
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2488]
test eax, eax
je 0x416b98
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x416ba4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22e4]
push eax
movzx eax, word [edi + 0xac]
push eax
push dword [edi + 0xa8]
push dword [edi + 0xa4]
push str.Microsoft_Windows__Version__lu._lu._05lu._lu__n
call fcn.0040dc00
mov eax, dword [edi + 0x10]
add esp, 0x14
test eax, eax
je 0x416be4
cmp word [eax + 0x40], 0
je 0x416be4
push dword [eax + 0x44]
push str.CommandLine____s__n
call fcn.0040dc00
add esp, 8
push dword [esi + 0x20]
push str.Process_ID___lu_n
call fcn.0040dc00
push dword [esi + 0x24]
push str.Thread__ID___lu_n
call fcn.0040dc00
push dword [esi + 0x6b4]
push str.Real_Process_ID___lu_n
call fcn.0040dc00
push dword [esi + 0x6b8]
push str.Real_Thread__ID___lu_n
call fcn.0040dc00
add esp, 0x20
push 0x11223344
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esi + 0x34]
push str.LastError__0x_08X_n
call fcn.0040dc00
push dword [esi + 0xbf4]
push str.LastStatus__0x_08X_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.LDR_Example_n_n
call fcn.0040dc00
add esp, 0x18
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push str.kernel32.dll__0x_08X_n
call fcn.0040dc00
add esp, 8
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416ca6
lea edx, [ebp - 0x24c4]
mov ecx, eax
call fcn.004016b0
test al, al
je 0x416ca6
push str.UnLinked_n
call fcn.0040dc00
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push str.kernel32.dll__0x_08X_n
call fcn.0040dc00
mov edx, dword [ebp - 0x24c4]
mov ecx, dword [ebp - 0x24c0]
push str.ReLinked_n
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x24b8]
mov dword [eax + 4], ecx
mov eax, dword [edx + 0x14]
mov dword [eax], ecx
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x24bc]
mov dword [eax + 4], ecx
mov eax, dword [edx + 0xc]
mov dword [eax], ecx
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x24b4]
mov dword [eax + 4], ecx
mov eax, dword [edx + 0x40]
mov dword [eax], ecx
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov eax, dword [edx + 0x54]
mov ecx, dword [ebp - 0x24b0]
mov dword [eax + 4], ecx
mov eax, dword [edx + 0x58]
mov dword [eax], ecx
mov eax, dword [edx + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x54]
mov dword [ecx], eax
call fcn.0040dc00
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push str.kernel32.dll__0x_08X_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.Codec_Example_n_n
call fcn.0040dc00
push 0x4ac090
call fcn.0041eb24
mov edi, eax
add esp, 0x14
test edi, edi
je 0x416e0f
push 0x7ff
push edi
call fcn.0041b700
mov esi, eax
add esp, 8
cmp esi, 0x7ff
je 0x416e06
test esi, esi
je 0x416e06
xor edx, edx
test esi, esi
je 0x416dce
mov cl, byte [edx + edi]
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x416dc9
and cl, 0xdf
mov byte [edx + edi], cl
inc edx
cmp edx, esi
jb 0x416db8
push edi
push str.UpperCase:___hs__n
call fcn.0040dc00
add esp, 8
xor edx, edx
test esi, esi
je 0x416df8
mov cl, byte [edx + edi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x416df3
or cl, 0x20
mov byte [edx + edi], cl
inc edx
cmp edx, esi
jb 0x416de2
push edi
push str.LowerCase:___hs__n
call fcn.0040dc00
add esp, 8
push edi
call fcn.0041eb78
add esp, 4
push 0x1000
push 0x4ac090
call fcn.0041b700
add esp, 8
test eax, eax
je 0x416f16
push 0
push 0
push eax
push 0x4ac090
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x22e8], esi
test esi, esi
jle 0x416f16
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
test edi, edi
je 0x415c14
cmp edi, 0xffffffff
je 0x415c14
lea eax, [esi*2 + 2]
push eax
push 8
push edi
mov dword [ebp - 0x22ec], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x415c14
push dword [ebp - 0x22ec]
push 0
push esi
call fcn.00419c70
push 0x1000
push 0x4ac090
call fcn.0041b700
add esp, 0x14
mov dword [ebp - 0x22ec], eax
test eax, eax
je 0x415c14
push 0
push 0
push eax
push 0x4ac090
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x415c14
push dword [ebp - 0x22e8]
push esi
push dword [ebp - 0x22ec]
push 0x4ac090
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x415c14
push esi
push str.Encode:___s__n
call fcn.0040dc00
add esp, 8
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x1000
push str.Hello__World_
call fcn.0041b822
add esp, 8
test eax, eax
je 0x417025
push 0
push 0
push 0
push 0
push eax
push str.Hello__World_
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov dword [ebp - 0x22e8], esi
test esi, esi
jle 0x417025
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
test edi, edi
je 0x415c14
cmp edi, 0xffffffff
je 0x415c14
lea eax, [esi + 1]
push eax
push 8
push edi
mov dword [ebp - 0x22ec], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x415c14
push dword [ebp - 0x22ec]
push 0
push esi
call fcn.00419c70
push 0x1000
push str.Hello__World_
call fcn.0041b822
add esp, 0x14
mov dword [ebp - 0x22ec], eax
test eax, eax
je 0x415c14
push 0
push 0
push 0
push 0
push eax
push str.Hello__World_
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x415c14
push 0
push 0
push dword [ebp - 0x22e8]
push esi
push dword [ebp - 0x22ec]
push str.Hello__World_
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x415c14
push esi
push str.Decode:___hs__n
call fcn.0040dc00
add esp, 8
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x4aae00
call fcn.0040dc00
push str.Hexadecimal_Example_n_n
call fcn.0040dc00
push 0x40
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.00419c70
add esp, 0x14
lea edx, [ebp - 0x160]
xor esi, esi
movzx ecx, byte [esi + 0x4ac090]
lea edx, [edx + 4]
mov eax, ecx
inc esi
shr eax, 4
and ecx, 0xf
movsx eax, byte [eax + str.0123456789ABCDEF]
mov word [edx - 4], ax
movsx eax, byte [ecx + str.0123456789ABCDEF]
mov word [edx - 2], ax
cmp esi, 0xe
jb 0x417054
lea eax, [ebp - 0x160]
push eax
push str.Encode:___s__n
call fcn.0040dc00
lea eax, [ebp - 0x160]
xorps xmm0, xmm0
push 0x1000
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.0041b822
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41710f
xor edx, edx
test esi, esi
je 0x4170fe
nop word [eax + eax]
movzx eax, byte [ebp + edx*2 - 0x160]
movzx ecx, byte [ebp + edx*2 - 0x15e]
mov al, byte [eax + 0x4aa4a0]
or al, byte [ecx + 0x4aa3a0]
mov byte [ebp - 0x248d], al
jne 0x4170e9
add edx, 2
jmp 0x4170f7
mov cl, byte [ebp - 0x248d]
mov eax, edx
shr eax, 1
mov byte [ebp + eax - 0x20], cl
add edx, 2
cmp edx, esi
jb 0x4170c0
lea eax, [ebp - 0x20]
push eax
push str.Decode:___hs__n
call fcn.0040dc00
add esp, 8
push 0x4aae00
call fcn.0040dc00
push str.Scan_Example_n_n
call fcn.0040dc00
add esp, 8
mov dword [ebp - 0x2488], 0
mov dword [ebp - 0x22e4], 0
mov dword [ebp - 0x2304], 0x7865742e
mov dword [ebp - 0x2300], 0x74
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x417192
lea ecx, [ebp - 0x22e4]
push ecx
lea ecx, [ebp - 0x2488]
push ecx
lea edx, [ebp - 0x2304]
mov ecx, eax
call fcn.00401780
add esp, 8
test al, al
je 0x417192
push dword [ebp - 0x2488]
push str.FindSection_...___0x_08X_n
call fcn.0040dc00
add esp, 8
push str.ntdll.dll
mov dword [ebp - 0x2488], 0
mov dword [ebp - 0x22e4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4171e4
lea ecx, [ebp - 0x22e4]
push ecx
lea ecx, [ebp - 0x2488]
push ecx
mov ecx, eax
call fcn.00401820
add esp, 8
test al, al
je 0x4171e4
push dword [ebp - 0x2488]
push str.FindSection_...___0x_08X_n
call fcn.0040dc00
add esp, 8
push str.ntdll.dll
mov dword [ebp - 0x2498], 0x7865742e
mov dword [ebp - 0x2494], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x417258
lea ecx, [ebp - 0x22e4]
mov dword [ebp - 0x2488], 0
push ecx
lea ecx, [ebp - 0x2488]
mov dword [ebp - 0x22e4], 0
push ecx
lea edx, [ebp - 0x2498]
mov ecx, eax
call fcn.00401780
add esp, 8
test al, al
jne 0x417241
xor eax, eax
jmp 0x417258
mov edx, dword [ebp - 0x22e4]
sub esp, 0x10
mov ecx, dword [ebp - 0x2488]
call fcn.004020b0
add esp, 0x10
push eax
push str.FindSignature_...___0x_08X_n
call fcn.0040dc00
add esp, 8
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41728e
mov edx, dword [eax + 0x3c]
mov ecx, eax
push 5
push 0x4ac210
mov edx, dword [edx + eax + 0x50]
dec edx
call fcn.00402730
add esp, 8
push eax
push str.FindData_...___0x_08X_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.RTTI_Example_n_n
call fcn.0040dc00
add esp, 0x10
push 0x4ac27c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
test edx, edx
jne 0x4172cb
xor esi, esi
mov dword [ebp - 0x22ec], esi
jmp 0x417315
mov eax, dword [edx + 0x3c]
lea ecx, [ebp - 0x248c]
push 1
push 0x4ac268
mov eax, dword [eax + edx + 0x50]
dec eax
push eax
push edx
call fcn.00403060
add esp, 0x10
mov esi, dword [eax]
mov dword [eax], 0
mov edi, dword [ebp - 0x248c]
mov dword [ebp - 0x22ec], esi
test edi, edi
je 0x417315
lea ecx, [edi + 0x20]
call fcn.0040b580
push 0x2c
push edi
call fcn.00418ab1
add esp, 8
mov dword [ebp - 0x2300], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x41739a
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
mov edx, esi
push 0
call fcn.00414730
mov edi, dword [esi + 0x1c]
push edi
push str.._AVTestingRTTI__
push str.__FindObject_...___GetVTable_...___hs__0x_08X_n
call fcn.0040dc00
add esp, 0x10
test edi, edi
je 0x41739a
mov esi, dword [edi]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____foo_____d_n
call fcn.0040dc00
mov esi, dword [edi + 4]
add esp, 8
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____boo_____d_n
call fcn.0040dc00
add esp, 8
push 4
call fcn.00418830
mov esi, eax
push 4
mov dword [ebp - 0x2488], esi
mov dword [esi], vtable.MessageOne.0
call fcn.00418830
mov edi, eax
mov ecx, esi
mov dword [ebp - 0x22e8], edi
mov dword [edi], vtable.MessageTwo.0
call fcn.004147f0
mov ecx, edi
call fcn.004147f0
push 0
push 0x4ac33c
lea ecx, [ebp - 0x23b0]
call fcn.00403310
push 1
push 0x4ac350
lea ecx, [ebp - 0x23b4]
mov byte [ebp - 4], 1
call fcn.00403310
push 1
push 0x4ac364
lea ecx, [ebp - 0x23b8]
mov byte [ebp - 4], 2
call fcn.00403310
mov eax, dword [ebp - 0x23b0]
push eax
push str.._AVBaseMessage__
push str.__FindObject_...___GetVTable_...___hs__0x_08X_n
mov dword [ebp - 0x22e4], eax
call fcn.0040dc00
mov edi, dword [ebp - 0x23b4]
push edi
push str.._AVMessageOne__
push str.__FindObject_...___GetVTable_...___hs__0x_08X_n
mov dword [ebp - 0x22fc], edi
call fcn.0040dc00
mov esi, dword [ebp - 0x23b8]
push esi
push str.._AVMessageTwo__
push str.__FindObject_...___GetVTable_...___hs__0x_08X_n
mov dword [ebp - 0x2494], esi
call fcn.0040dc00
mov eax, dword [ebp - 0x22e4]
add esp, 0x44
test eax, eax
je 0x4174f7
test edi, edi
je 0x4174f7
test esi, esi
je 0x4174f7
test edi, edi
je 0x417497
push dword [edi + 0xc]
mov ecx, dword [ebp - 0x2488]
push dword [eax + 0xc]
call fcn.00402eb0
add esp, 8
jmp 0x417499
xor eax, eax
push eax
push dword [ebp - 0x2488]
push str.._AVMessageOne__
push str.._AVBaseMessage__
push str.__BaseMessage__DynamicCast_...___hs______hs____0x_08X____0x_08X__n
call fcn.0040dc00
add esp, 0x14
test esi, esi
je 0x4174d7
mov eax, dword [ebp - 0x22e4]
push dword [esi + 0xc]
mov ecx, dword [ebp - 0x2488]
push dword [eax + 0xc]
call fcn.00402eb0
add esp, 8
jmp 0x4174d9
xor eax, eax
push eax
push dword [ebp - 0x2488]
push str.._AVMessageTwo__
push str.._AVBaseMessage__
push str.__BaseMessage__DynamicCast_...___hs______hs____0x_08X____0x_08X__n
call fcn.0040dc00
add esp, 0x14
mov eax, dword [ebp - 0x2488]
push 1
mov eax, dword [eax]
mov esi, dword [eax]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [ebp - 0x2488]
call esi
mov ecx, dword [ebp - 0x22e8]
push 1
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [ebp - 0x22e8]
call esi
push 0x4aae00
call fcn.0040dc00
push str.Parallel_Example_n_n
call fcn.0040dc00
xorps xmm0, xmm0
mov dword [ebp - 0x231c], 0
movq qword [ebp - 0x2324], xmm0
add esp, 8
mov dword [ebp - 0x2324], 0x414880
mov dword [ebp - 0x2320], 0
mov dword [ebp - 0x231c], 0
push 0
push 0
lea eax, [ebp - 0x2324]
mov byte [ebp - 4], 4
push eax
push 0x4038a0
push 0
push 0
mov dword [ebp - 0x23c0], 0x4148a0
mov dword [ebp - 0x23bc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x231c], eax
test eax, eax
je 0x4175c1
cmp eax, 0xffffffff
je 0x4175c1
mov eax, 1
jmp 0x4175c3
xor eax, eax
push eax
push str.DetoursThread.Start_____d_n
call fcn.0040dc00
add esp, 8
lea ecx, [ebp - 0x2324]
call fcn.004038f0
movzx eax, al
push eax
push str.DetoursThread.Join_____d_n
call fcn.0040dc00
add esp, 8
lea ecx, [ebp - 0x23c0]
call fcn.004039d0
movzx eax, al
push eax
push str.DetoursFiber.Switch_____d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.Memory_Example_n_n
call fcn.0040dc00
xorps xmm0, xmm0
mov dword [ebp - 0x2308], 0
movups xmmword [ebp - 0x2318], xmm0
push 0x20
mov dword [ebp - 0x230c], 0
mov dword [ebp - 0x2308], 0
call fcn.00418830
add esp, 0x14
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x230c], eax
mov byte [ebp - 4], 5
mov ecx, dword [0x4b1738]
test ecx, ecx
je 0x41766e
cmp dword [0x4b173c], 0
jne 0x417698
lea eax, [ebp - 0x2484]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2468]
mov ecx, dword [ebp - 0x2480]
mov dword [0x4b173c], eax
mov eax, dword [ebp - 0x230c]
mov dword [0x4b1738], ecx
mov dword [ebp - 0x248c], ecx
mov dword [ebp - 0x2318], ecx
mov dword [ebp - 0x2314], ecx
lea ecx, [ebp - 0x248c]
push ecx
push eax
lea ecx, [ebp - 0x230c]
mov dword [ebp - 0x2310], 0
call fcn.0040bf90
sub esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2318]
call fcn.00404300
mov esi, eax
mov dword [ebp - 0x248c], esi
test esi, esi
je 0x41785f
push dword [ebp - 0x2318]
push str.Storage.GetCapacity_____d_n
call fcn.0040dc00
push dword [ebp - 0x2310]
push str.Storage.GetSize_____d_n
call fcn.0040dc00
add esp, 0x10
mov word [esi], 0x1b0
lea eax, [ebp - 0x23dc]
mov byte [esi + 2], 0xc3
xorps xmm0, xmm0
mov dword [ebp - 0x23c4], 0
movups xmmword [ebp - 0x23dc], xmm0
push 0x1c
push eax
push esi
movq qword [ebp - 0x23cc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x23dc]
mov dword [ebp - 0x23c4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x23dc], xmm0
movq qword [ebp - 0x23cc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x4177a6
push dword [ebp - 0x23d0]
push dword [ebp - 0x23dc]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4177a6
lea eax, [ebp - 0x22f0]
mov dword [ebp - 0x22f0], 0
push eax
push 0x20
push 3
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call dword [0x42f1cc]
call esi
movzx eax, al
push eax
push str.pCodeMemory_____d_n
call fcn.0040dc00
add esp, 8
cmp dword [ebp - 0x2308], 0
je 0x41785f
mov eax, dword [ebp - 0x230c]
mov esi, dword [eax]
cmp esi, eax
je 0x41785f
nop
push dword [ebp - 0x248c]
lea ecx, [esi + 8]
call fcn.00403c50
test al, al
jne 0x417800
mov eax, dword [esi]
mov esi, eax
cmp eax, dword [ebp - 0x230c]
jne 0x4177e0
jmp 0x41785f
lea ecx, [esi + 8]
call fcn.00403e10
sub dword [ebp - 0x2310], eax
lea edx, [esi + 8]
cmp dword [edx + 0x14], 0
jne 0x41785f
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [ebp - 0x2308]
mov eax, dword [edx + 4]
test eax, eax
je 0x417844
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea edx, [esi + 8]
lea ecx, [edx + 0x10]
call fcn.0040b540
lea ecx, [esi + 0x10]
call fcn.0040b540
push 0x20
push esi
call fcn.00418ab1
add esp, 8
push 0x4aae00
call fcn.0040dc00
push str.Exception_Example_n_n
call fcn.0040dc00
add esp, 8
push 0x4148c0
call fcn.00404af0
movzx eax, al
push eax
push str.g_ExceptionListener.AddCallBack_...____d_n
call fcn.0040dc00
push 7
push 6
push 5
push 4
push 3
push 2
push 1
call fcn.004186e0
add esp, 0x24
mov ecx, 0x4b164c
push 0x4148c0
call fcn.00404c00
movzx eax, al
push eax
push str.g_ExceptionListener.RemoveCallBack_...____d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
push str.Hook_Example_n_n
call fcn.0040dc00
add esp, 0x10
mov dword [ebp - 0x248c], 0x414990
cmp dword [sym.imp.KERNEL32.dll_Sleep], 0
mov edx, 0x414990
je 0x417a4e
mov eax, edx
mov dword [ebp - 0x22f0], 0x414990
shr eax, 8
movzx ecx, al
movzx eax, dl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp - 0x22f0]
push eax
lea eax, [ebp - 0x24ec]
push eax
call fcn.0040daf0
mov edx, dword [0x4b1744]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
mov dword [ebp - 0x22f0], edx
cmp edx, dword [0x4b1744]
jne 0x417a4e
push 0x10
call fcn.00418830
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x22e8], esi
add esp, 4
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x22e8], esi
movups xmmword [esi], xmm0
mov dword [esi], eax
mov dword [esi + 4], 1
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test esi, esi
mov byte [ebp - 4], 7
mov ecx, esi
setne al
test al, al
jne 0x4179d8
mov byte [ebp - 4], 6
call fcn.00408cd0
push 0x10
push esi
call fcn.00418ab1
push 0
push str.HookMemory___d_n
call fcn.0040dc00
add esp, 0x10
jmp 0x417a5d
push 0x414990
call fcn.00408ae0
test al, al
jne 0x417a0a
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.00408cd0
push 0x10
push esi
call fcn.00418ab1
push 0
push str.HookMemory___d_n
call fcn.0040dc00
add esp, 0x10
jmp 0x417a5d
lea eax, [ebp - 0x22e8]
push eax
lea eax, [ebp - 0x248c]
push eax
push dword [ebp - 0x22f0]
lea eax, [ebp - 0x24a0]
push eax
call fcn.0040c460
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x22e8]
test esi, esi
je 0x417a4a
mov ecx, esi
call fcn.00408cd0
push 0x10
push esi
call fcn.00418ab1
add esp, 8
push 1
jmp 0x417a50
push 0
push str.HookMemory___d_n
call fcn.0040dc00
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x414990
mov dword [ebp - 0x22f0], 0x414990
mov eax, edx
shr eax, 8
movzx ecx, al
movzx eax, dl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x22f0]
push eax
lea eax, [ebp - 0x24dc]
push eax
call fcn.0040daf0
mov esi, dword [0x4b1744]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
cmp esi, dword [0x4b1744]
jne 0x417ae1
xor eax, eax
jmp 0x417ba5
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x417aef
xor eax, eax
jmp 0x417ba5
call fcn.00408cd0
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x4b1758]
and ecx, eax
mov eax, dword [0x4b174c]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x417b56
cmp eax, esi
jne 0x417b4e
mov eax, dword [0x4b1744]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x417b5e
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x417b5e
cmp eax, esi
jne 0x417b5e
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [0x4b1748]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x22f0], eax
test eax, eax
je 0x417b95
mov ecx, eax
call fcn.00408cd0
push 0x10
push dword [ebp - 0x22f0]
call fcn.00418ab1
add esp, 8
push 0x10
push esi
call fcn.00418ab1
add esp, 8
mov eax, 1
push eax
push str.UnHookMemory___d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
mov edx, 0x4149c0
mov dword [ebp - 0x248c], 0x4149c0
mov eax, edx
mov dword [ebp - 0x22f0], 0x4149c0
shr eax, 8
add esp, 0xc
movzx ecx, al
movzx eax, dl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x22f0]
push eax
lea eax, [ebp - 0x24e4]
push eax
call fcn.0040db60
mov esi, dword [0x4b1764]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
cmp esi, dword [0x4b1764]
je 0x417c40
xor eax, eax
jmp 0x417cd6
push 8
call fcn.00418830
mov ecx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x24a0], ecx
add esp, 4
mov dword [ebp - 0x22e8], ecx
movq qword [ecx], xmm0
mov byte [ecx], 0x7e
mov dword [ecx + 4], 0
test ecx, ecx
mov byte [ebp - 4], 8
setne al
test al, al
jne 0x417c89
push 8
push ecx
mov byte [ebp - 4], 6
call fcn.00418ab1
add esp, 8
xor eax, eax
jmp 0x417cd6
lea eax, [ebp - 0x22e8]
mov dword [ecx + 4], 0x4149c0
push eax
lea eax, [ebp - 0x248c]
push eax
push esi
lea eax, [ebp - 0x22f4]
push eax
call fcn.0040c6c0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x22e8]
test eax, eax
je 0x417cd1
cmp dword [eax + 4], 0
je 0x417cc6
mov dword [eax + 4], 0
push 8
push eax
call fcn.00418ab1
add esp, 8
mov eax, 1
push eax
push str.HookInterrupt___d_n
call fcn.0040dc00
push 7
push 6
push 5
push 4
push 3
push 2
push 1
call fcn.004186e0
call fcn.00408e50
movzx eax, al
push eax
push str.UnHookInterrupt___d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
add esp, 0x30
push 0x4ac27c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
test edx, edx
jne 0x417d2f
xor esi, esi
mov dword [ebp - 0x22e8], esi
jmp 0x417d84
mov eax, dword [edx + 0x3c]
lea ecx, [ebp - 0x249c]
push 1
push 0x4ac268
mov eax, dword [eax + edx + 0x50]
dec eax
push eax
push edx
call fcn.00403060
add esp, 0x10
mov esi, dword [eax]
mov dword [eax], 0
mov eax, dword [ebp - 0x249c]
mov dword [ebp - 0x22e8], esi
mov dword [ebp - 0x22f0], eax
test eax, eax
je 0x417d84
lea ecx, [eax + 0x20]
call fcn.0040b580
push 0x2c
push dword [ebp - 0x22f0]
call fcn.00418ab1
add esp, 8
mov dword [ebp - 0x22f4], esi
mov byte [ebp - 4], 9
test esi, esi
je 0x418051
mov esi, dword [esi + 0x1c]
push esi
push str.._AVTestingRTTI__
push str.__FindObject_...___GetVTable_...___hs__0x_08X_n
mov dword [ebp - 0x2488], esi
call fcn.0040dc00
add esp, 0xc
test esi, esi
je 0x41803e
mov esi, dword [esi]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____foo_____d_n
call fcn.0040dc00
mov esi, dword [ebp - 0x2488]
add esp, 8
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____boo_____d_n
call fcn.0040dc00
add esp, 8
cmp byte [0x4b1724], 0
jne 0x417e3e
mov eax, dword [ebp - 0x2488]
mov dword [0x4b1728], eax
mov dword [0x4b172c], 0
mov eax, dword [eax]
mov dword [0x4b1730], eax
mov eax, 1
mov byte [0x4b1724], 1
jmp 0x417e40
xor eax, eax
push eax
push str.fooHook.Set_...____d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b1724
push 0x414a60
call fcn.00408fa0
movzx eax, al
push eax
push str.fooHook.Hook_...____d_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2488]
add esp, 8
mov esi, dword [eax]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____foo_____d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b1724
call fcn.00409190
movzx eax, al
push eax
push str.fooHook.UnHook_____d_n
call fcn.0040dc00
add esp, 8
cmp byte [0x4b16fc], 0
jne 0x417ee8
mov eax, dword [ebp - 0x2488]
mov dword [0x4b1700], eax
mov dword [0x4b1704], 1
mov eax, dword [eax + 4]
mov dword [0x4b1708], eax
mov eax, 1
mov byte [0x4b16fc], 1
jmp 0x417eea
xor eax, eax
push eax
push str.booHook.Set_...____d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16fc
push 0x414a90
call fcn.00408fa0
movzx eax, al
push eax
push str.booHook.Hook_...____d_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2488]
add esp, 8
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____boo_____d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16fc
call fcn.00409190
movzx eax, al
push eax
push str.booHook.UnHook_____d_n
call fcn.0040dc00
add esp, 8
mov dword [ebp - 0x24ac], 0
cmp byte [0x4b16e4], 0
mov dword [ebp - 0x24a8], 0x414ac0
jne 0x417f9f
mov eax, dword [ebp - 0x2488]
mov dword [0x4b16e8], eax
mov eax, 1
mov dword [0x4b16ec], 2
mov byte [0x4b16e4], 1
jmp 0x417fa1
xor eax, eax
push eax
push str.NewTestingRTTIVTable.Set_...____d_n
call fcn.0040dc00
add esp, 8
lea eax, [ebp - 0x24ac]
push eax
call fcn.004092b0
movzx eax, al
push eax
push str.NewTestingRTTIVTable.Hook_...____d_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2488]
add esp, 8
mov esi, dword [eax]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____foo_____d_n
call fcn.0040dc00
mov eax, dword [ebp - 0x2488]
add esp, 8
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
xor edx, edx
call esi
movzx eax, al
push eax
push str.____boo_____d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16e4
call fcn.00409460
movzx eax, al
push eax
push str.NewTestingRTTIVTable.UnHook_____d_n
call fcn.0040dc00
add esp, 8
push 0x4aae00
call fcn.0040dc00
mov esi, dword [ebp - 0x22e8]
add esp, 4
mov byte [ebp - 4], 6
test esi, esi
je 0x41806c
lea ecx, [esi + 0x20]
call fcn.0040b580
push 0x2c
push esi
call fcn.00418ab1
add esp, 8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 0x249c], esi
test esi, esi
je 0x41815d
cmp esi, 0xffffffff
je 0x41815d
push 0x4ac928
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x4b170c], 0
jne 0x4180f6
test eax, eax
je 0x4180f6
mov dword [0x4b1710], eax
mov eax, dword [0x4b1720]
mov dword [0x4b1714], 0
mov dword [0x4b1718], 0
mov dword [0x4b1720], 0
test eax, eax
je 0x4180de
push eax
call fcn.0041882b
add esp, 4
mov dword [0x4b171c], 0
mov eax, 1
mov byte [0x4b170c], 1
jmp 0x4180f8
xor eax, eax
push eax
push str.InlineSleepHook.Set___d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b170c
push 1
push 1
push 0x414af0
call fcn.004094c0
movzx eax, al
push eax
push str.InlineSleepHook.Hook___d_n
call fcn.0040dc00
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, 0x4b170c
call fcn.00409ba0
movzx eax, al
push eax
push str.InlineSleepHook.UnHook___d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
add esp, 0xc
jmp 0x41817b
push 0x4aae00
call fcn.0040dc00
add esp, 4
test esi, esi
je 0x4182c4
cmp esi, 0xffffffff
je 0x4182c4
push 0x4ac928
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x4b16c8], 0
jne 0x4181e8
test eax, eax
je 0x4181e8
mov dword [0x4b16cc], eax
mov eax, dword [0x4b16e0]
mov dword [0x4b16d0], 0
mov dword [0x4b16d8], 0
mov byte [0x4b16d4], 0
mov dword [0x4b16e0], 0
test eax, eax
je 0x4181d0
push eax
call fcn.0041882b
add esp, 4
mov dword [0x4b16dc], 0
mov eax, 1
mov byte [0x4b16c8], 1
jmp 0x4181ea
xor eax, eax
push eax
push str.RawSleepHook.Set___d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16c8
push 1
push 1
push 0
push 0
push 0x415420
call fcn.00409ea0
movzx eax, al
push eax
push str.RawSleepHook.Hook___d_n
call fcn.0040dc00
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, 0x4b16c8
call fcn.0040aec0
movzx eax, al
push eax
push str.RawSleepHook.UnHook___d_n
call fcn.0040dc00
add esp, 8
cmp byte [0x4b16c8], 0
jne 0x418254
xor eax, eax
jmp 0x4182b6
push ecx
mov ecx, 0x4b16c8
call fcn.0040aec0
mov eax, dword [0x4b16e0]
mov dword [0x4b16cc], 0
mov dword [0x4b16d0], 0
mov dword [0x4b16d8], 0
mov byte [0x4b16d4], 0
mov dword [0x4b16e0], 0
test eax, eax
je 0x4182a0
push eax
call fcn.0041882b
add esp, 4
mov dword [0x4b16dc], 0
mov eax, 1
mov byte [0x4b16c8], 0
push eax
push str.RawSleepHook.Release___d_n
call fcn.0040dc00
add esp, 8
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x24d4]
mov dword [edi], eax
mov eax, edi
mov edi, dword [ebp - 0x22fc]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x24c8]
shr eax, 0x19
test al, 1
je 0x41846f
mov eax, dword [ebp - 0x249c]
test eax, eax
je 0x41846f
cmp eax, 0xffffffff
je 0x41846f
push 0x4ac928
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x4b16c8], 0
jne 0x41837f
test eax, eax
je 0x41837f
mov dword [0x4b16cc], eax
mov eax, dword [0x4b16e0]
mov dword [0x4b16d0], 0
mov dword [0x4b16d8], 0
mov byte [0x4b16d4], 0
mov dword [0x4b16e0], 0
test eax, eax
je 0x418367
push eax
call fcn.0041882b
add esp, 4
mov dword [0x4b16dc], 0
mov eax, 1
mov byte [0x4b16c8], 1
jmp 0x418381
xor eax, eax
push eax
push str.RawSleepHook.Set___d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16c8
push 1
push 1
push 0
push 0
push 0x415460
call fcn.00409ea0
movzx eax, al
push eax
push str.RawSleepHook.Hook___d_n
call fcn.0040dc00
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.LastXMM7__0x
call fcn.0040dc00
add esp, 4
mov esi, 0xf
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [esi + 0x4b163c]
push eax
push str._02X
call fcn.0040dc00
add esp, 8
sub esi, 1
jns 0x4183e0
push 0x4aae00
call fcn.0040dc00
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.LastXMM7__0x
call fcn.0040dc00
add esp, 4
mov esi, 0xf
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [esi + 0x4b163c]
push eax
push str._02X
call fcn.0040dc00
add esp, 8
sub esi, 1
jns 0x418430
push 0x4aae00
call fcn.0040dc00
mov ecx, 0x4b16c8
call fcn.0040aec0
movzx eax, al
push eax
push str.RawSleepHook.UnHook___d_n
call fcn.0040dc00
add esp, 8
push 0x4aae00
call fcn.0040dc00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4184df
mov ecx, dword [eax + 0x3c]
mov edx, eax
push 1
push 0x4ac268
mov ecx, dword [ecx + eax + 0x50]
dec ecx
push ecx
push eax
lea ecx, [ebp - 0x24a4]
call fcn.00403060
add esp, 0x10
mov esi, dword [eax]
mov dword [eax], 0
mov eax, dword [ebp - 0x24a4]
mov dword [ebp - 0x22fc], eax
test eax, eax
je 0x4184d9
lea ecx, [eax + 0x20]
call fcn.0040b580
push 0x2c
push dword [ebp - 0x22fc]
call fcn.00418ab1
add esp, 8
mov eax, esi
mov ecx, esi
jmp 0x4184e5
xor esi, esi
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x22fc], esi
mov byte [ebp - 4], 0xa
test eax, eax
je 0x4185ee
cmp byte [0x4b16ac], 0
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax]
jne 0x41855d
test eax, eax
je 0x41855d
mov dword [0x4b16b0], eax
mov eax, dword [0x4b16c4]
mov dword [0x4b16b4], 0
mov dword [0x4b16bc], 0
mov byte [0x4b16b8], 0
mov dword [0x4b16c4], 0
test eax, eax
je 0x418545
push eax
call fcn.0041882b
add esp, 4
mov dword [0x4b16c0], 0
mov eax, 1
mov byte [0x4b16ac], 1
jmp 0x41855f
xor eax, eax
push eax
push str.RawHook_CallConv_Convert.Set___d_n
call fcn.0040dc00
add esp, 8
mov ecx, 0x4b16ac
push 1
push 1
push 0x10
push 1
push 0x4156a0
call fcn.00409ea0
movzx eax, al
push eax
push str.RawHook_CallConv_Convert.Hook___d_n
call fcn.0040dc00
mov eax, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
add esp, 8
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x249c], eax
call dword [0x42f1cc]
mov ecx, dword [sym.Detours.exe_class_TestingRTTI__g_pTestingRTTI]
call dword [ebp - 0x249c]
movzx eax, al
push eax
push str.g_pTestingRTTI__foo___d_n
call fcn.0040dc00
add esp, 4
mov ecx, 0x4b16ac
call fcn.0040aec0
movzx eax, al
push eax
push str.RawHook_CallConv_Convert.UnHook___d_n
call fcn.0040dc00
push 0x4aae00
call fcn.0040dc00
add esp, 0xc
mov byte [ebp - 4], 6
test esi, esi
je 0x418609
lea ecx, [esi + 0x20]
call fcn.0040b580
push 0x2c
push esi
call fcn.00418ab1
add esp, 8
call sym.Detours.exe_DemoHook
push str.__FINISHED___n
call fcn.0040dc00
call fcn.0041ecf8
mov edx, dword [ebp - 0x230c]
call fcn.0040c920
push 0x20
push dword [ebp - 0x230c]
call fcn.00418ab1
add esp, 0xc
lea ecx, [ebp - 0x2324]
call fcn.004038f0
mov esi, dword [ebp - 0x2494]
test esi, esi
je 0x418660
lea ecx, [esi + 0x20]
call fcn.0040b580
push 0x2c
push esi
call fcn.00418ab1
add esp, 8
test edi, edi
je 0x418677
lea ecx, [edi + 0x20]
call fcn.0040b580
push 0x2c
push edi
call fcn.00418ab1
add esp, 8
mov esi, dword [ebp - 0x22e4]
test esi, esi
je 0x418694
lea ecx, [esi + 0x20]
call fcn.0040b580
push 0x2c
push esi
call fcn.00418ab1
add esp, 8
mov esi, dword [ebp - 0x22ec]
test esi, esi
je 0x415b3a
lea ecx, [esi + 0x20]
call fcn.0040b580
push 0x2c
push esi
call fcn.00418ab1
add esp, 8
xor eax, eax
jmp 0x415c17