Function at 0x100875ac
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10164f1b
adc byte [eax - 0x75], dl
inc esp
and al, 0x10
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffffe
xor ebx, ebx
cmp eax, 0x32
push edi
ja case.default.0x100875d8
mov ebp, dword [esp + 0x28]
jmp dword [eax*4 + 0x1008812c]
push 0
push 0x100836d0
push esi
mov ecx, esi
call fcn.10082c40
push 1
mov ebx, eax
push 0x10082ee0
mov ecx, esi
push esi
call fcn.10082c40
mov edi, eax
test edi, edi
je case.0x100875d8.10
test ebp, ebp
je case.0x100875d8.10
lea edx, [esi + 0x30]
push edx
push 0x40
push 0x10
adc byte [edi - 1], dl
adc eax, sym.imp.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x100880c9
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push edi
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 0x34], eax
jmp case.0x100875d8.10
mov ecx, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], ecx
push 0x10083f40
mov ecx, esi
push esi
call fcn.10082c40
mov edi, eax
test edi, edi
je case.default.0x100875d8
lea eax, [esi + 0x30]
push eax
push 0x40
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10087cbb
mov ecx, dword [esi + 0x3c]
push edi
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], edx
push 0x10083fb0
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x100876d8
push 2
push 8
push 7
mov ecx, eax
call fcn.1003ef40
jmp 0x100876da
xor eax, eax
push 0
push 0x10086d20
push esi
mov ecx, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [esi + 0x4c], eax
call fcn.10082c40
push 1
mov ebx, eax
push 0x10086e30
jmp 0x100875f7
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], eax
push 0x10083c30
jmp 0x10087651
push 0x5c
call fcn.1015294a
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 1
je 0x10087742
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov ecx, eax
call fcn.100574d0
jmp 0x10087744
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x5c], eax
push 0x10084030
jmp 0x10087651
push 0
push 0x10083080
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 2
je 0x10087790
push 0
push 6
push 2
mov ecx, eax
call fcn.1003ef40
jmp 0x10087792
xor eax, eax
push 0
push 0x10086ed0
push esi
mov ecx, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [esi + 0x4c], eax
call fcn.10082c40
push 1
mov ebx, eax
push 0x10082f90
jmp 0x100875f7
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], eax
push 0x10087420
jmp 0x10087651
push 0x5c
call fcn.1015294a
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 3
je 0x100877fa
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov ecx, eax
call fcn.100574d0
jmp 0x100877fc
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x60], eax
push 0x100840b0
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 4
je 0x1008783c
push 2
push 0xc
push 9
mov ecx, eax
call fcn.1003ef40
jmp 0x1008783e
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10082e50
jmp 0x100875f7
mov eax, dword [esp + 0x28]
push 0x64
mov dword [esi + 0x40], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 5
je 0x10087881
push 0
mov ecx, eax
call fcn.10019af0
jmp 0x10087883
xor eax, eax
mov ecx, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x54], eax
call fcn.100191c0
test eax, eax
je 0x10087c9d
mov ecx, dword [esi + 0x54]
call fcn.10019fa0
push 0
push 0x10086b10
jmp 0x10087651
mov ecx, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], ecx
push 0x10086a40
jmp 0x10087651
mov edx, dword [esp + 0x2c]
push 0
push 0x100839b0
push esi
mov ecx, esi
mov dword [esi + 0x40], edx
call fcn.10082c40
mov ebx, eax
jmp case.0x100875d8.10
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], eax
push 0x10086970
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 6
je 0x10087917
mov ecx, eax
call fcn.1003eef0
jmp 0x10087919
xor eax, eax
or edi, 0xffffffff
push 0x28
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 7
je 0x10087957
mov ecx, eax
call fcn.1003eef0
push 0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x100866d0
jmp 0x10087651
xor eax, eax
push eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x100866d0
jmp 0x10087651
mov ecx, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], ecx
push 0x10086600
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 8
je 0x100879a1
mov ecx, eax
call fcn.1003eef0
jmp 0x100879a3
xor eax, eax
or edi, 0xffffffff
push 0x28
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 9
je 0x100879d0
mov ecx, eax
call fcn.1003eef0
jmp 0x100879d2
xor eax, eax
push 0
push 0x100836d0
push esi
mov ecx, esi
mov dword [esp + 0x24], edi
mov dword [esi + 0x50], eax
call fcn.10082c40
push 1
mov ebx, eax
push 0x100864c0
jmp 0x100875f7
mov edx, dword [esp + 0x28]
push 0x28
mov dword [esi + 0x40], edx
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xa
je 0x10087a20
mov ecx, eax
call fcn.1003eef0
jmp 0x10087a22
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10086380
jmp 0x10087651
mov eax, dword [esp + 0x28]
push 0x28
mov dword [esi + 0x40], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xb
je 0x10087a63
mov ecx, eax
call fcn.1003eef0
jmp 0x10087a65
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10086240
jmp 0x10087651
mov ecx, dword [esp + 0x28]
push 0x28
mov dword [esi + 0x40], ecx
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xc
je 0x10087aa6
mov ecx, eax
call fcn.1003eef0
jmp 0x10087aa8
xor eax, eax
or edi, 0xffffffff
push 0x28
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xd
je 0x10087ae6
mov ecx, eax
call fcn.1003eef0
push 0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x10085ea0
jmp 0x10087651
xor eax, eax
push eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x10085ea0
jmp 0x10087651
mov edx, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], edx
push 0x10085de0
jmp 0x10087651
push 0
push 0x10083860
push esi
mov ecx, esi
call fcn.10082c40
mov ebx, eax
jmp case.0x100875d8.10
push 0
push 0x10083720
jmp 0x10087651
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], eax
push 0x10085d10
jmp 0x10087651
mov ecx, dword [esp + 0x28]
push 0x28
mov dword [esi + 0x40], ecx
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xe
je 0x10087b6c
mov ecx, eax
call fcn.1003eef0
jmp 0x10087b6e
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10085bb0
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0xf
je 0x10087ba8
mov ecx, eax
call fcn.1003eef0
jmp 0x10087baa
xor eax, eax
or edi, 0xffffffff
push 0x28
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x10
je 0x10087be8
mov ecx, eax
call fcn.1003eef0
push 0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x10085780
jmp 0x10087651
xor eax, eax
push eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push 0x10085780
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x11
je 0x10087c1f
mov ecx, eax
call fcn.1003eef0
jmp 0x10087c21
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10085600
jmp 0x10087651
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push 0
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
push 0x100872c0
jmp 0x10087651
mov edx, dword [esp + 0x28]
push 0x64
mov dword [esi + 0x40], edx
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x12
je 0x10087c85
push 0
mov ecx, eax
call fcn.10019af0
jmp 0x10087c87
xor eax, eax
mov ecx, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x54], eax
call fcn.100191c0
test eax, eax
jne 0x10087ce0
mov edi, dword [esi + 0x54]
test edi, edi
je 0x10087cb4
mov ecx, edi
call fcn.100197a0
push edi
call fcn.10152975
add esp, 4
mov dword [esi + 0x54], 0
mov ecx, esi
call fcn.100832a0
push esi
call fcn.10152975
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
mov ecx, dword [esi + 0x54]
call fcn.10019fa0
mov ecx, dword [esi + 0x54]
call fcn.10019fa0
push 0
push 0x10085340
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x13
je 0x10087d1f
mov ecx, eax
call fcn.1003eef0
jmp 0x10087d21
xor eax, eax
or edi, 0xffffffff
push 0x28
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], eax
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x14
je 0x10087d5f
mov ecx, eax
call fcn.1003eef0
push 0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push fcn.10085120
jmp 0x10087651
xor eax, eax
push eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x50], eax
push fcn.10085120
jmp 0x10087651
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 0x40], eax
push 0x10083580
jmp 0x10087651
push 0x28
call fcn.1015294a
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x18], 0x15
je 0x10087da9
mov ecx, eax
call fcn.1003eef0
jmp 0x10087dab
xor eax, eax
push 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x4c], eax
push 0x10083510
jmp 0x10087651
push 0x28
invalid