Function at 0x5c3bc1
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
jae 0x5c3bbf
jmp 0x5c3bba
call fcn.005c3bc1
jae 0x5c3bba
add esp, 4
jmp 0x5c3bc6
dec dword [esp]
jno 0x5c3bcb
jns 0x5c3bb6
jp 0x5c3bcf
add esp, 4
popf
jmp 0x5c3bd6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5c3bef
jne 0x5c3bef
call 0x101c6f43
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 4], 0
push 0x3835db1
lea ecx, [ebp - 0x441]
call fcn.005c7a00
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x441]
call fcn.005b3c70
mov edx, dword [0x7fe890]
cmp dword [edx + 0xc], 0
jne 0x5c3c5b
mov dword [ebp - 4], 1
push 0x4bfb6a8b
lea ecx, [ebp - 0x44d]
call fcn.005c7a80
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x264], eax
lea ecx, [ebp - 0x44d]
call fcn.005b3dc0
mov edx, dword [0x7fe890]
cmp dword [edx + 0x264], 0
jne 0x5c3cb5
mov dword [ebp - 4], 0x1b
push 0x6c38efa3
lea ecx, [ebp - 0x458]
call fcn.005c7b00
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x178], eax
lea ecx, [ebp - 0x458]
call fcn.005b3ee0
mov edx, dword [0x7fe890]
cmp dword [edx + 0x178], 0
jne 0x5c3d1c
push str.WinAPITable__OpenThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
mov eax, 0xb38a6ce5
push eax
lea ecx, [ebp - 0x468]
call fcn.005c7b80
mov dword [ebp - 0x4f8], eax
mov ecx, dword [ebp - 0x4f8]
push ecx
mov edx, dword [0x7fe88c]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x158], eax
lea ecx, [ebp - 0x468]
call fcn.005d3930
mov edx, dword [0x7fe890]
cmp dword [edx + 0x158], 0
jne 0x5c3d84
push str.WinAPITable__OpenThreadToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x17e95a18
lea ecx, [ebp - 0x474]
call fcn.005c7c00
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x17c], eax
lea ecx, [ebp - 0x474]
call fcn.005b3dc0
mov edx, dword [0x7fe890]
cmp dword [edx + 0x17c], 0
jne 0x5c3deb
push str.WinAPITable__OpenProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
mov eax, 0xfb12434b
push eax
lea ecx, [ebp - 0x488]
call fcn.005c7c80
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp - 0x500]
push ecx
mov edx, dword [0x7fe88c]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x180], eax
lea ecx, [ebp - 0x488]
call fcn.005b3f70
mov edx, dword [0x7fe890]
cmp dword [edx + 0x180], 0
jne 0x5c3e53
push str.WinAPITable__MultiByteToWideChar_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x33dca90b
lea ecx, [ebp - 0x4a3]
call fcn.005c7d00
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x184], eax
lea ecx, [ebp - 0x4a3]
call fcn.005c6c20
mov edx, dword [0x7fe890]
cmp dword [edx + 0x184], 0
jne 0x5c3eba
push str.WinAPITable__WinStationTerminateProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x2860a851
lea ecx, [ebp - 0x4af]
call fcn.005c7d80
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xbc], eax
lea ecx, [ebp - 0x4af]
call fcn.005b3dc0
mov edx, dword [0x7fe890]
cmp dword [edx + 0xbc], 0
jne 0x5c3f21
push str.WinAPITable__CloseHandle_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
mov eax, 0xb1bf7f06
push eax
lea ecx, [ebp - 0x4bd]
call fcn.005c7e00
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
push ecx
mov edx, dword [0x7fe88c]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x154], eax
lea ecx, [ebp - 0x4bd]
call fcn.005b3cd0
mov edx, dword [0x7fe890]
cmp dword [edx + 0x154], 0
jne 0x5c3fdd
mov eax, 0xdfa87136
push eax
lea ecx, [ebp - 0x4cb]
call fcn.005c7e80
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
push ecx
mov edx, dword [0x7fe88c]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x154], eax
lea ecx, [ebp - 0x4cb]
call fcn.005b3cd0
mov edx, dword [0x7fe890]
cmp dword [edx + 0x154], 0
jne 0x5c3fdd
push str.WinAPITable__EnumProcesses_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x1b37aa75
lea ecx, [ebp - 0x4e1]
call fcn.005c7f00
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
push eax
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1dc], eax
lea ecx, [ebp - 0x4e1]
call fcn.005c6c50
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1dc], 0
jne 0x5c4044
push str.WinAPITable__LookupPrivilegeValueA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.GetProcessImageFileNameA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x168], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x168], 0
jne 0x5c4086
push str.WinAPITable__GetProcessImageFileNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.GetModuleFileNameExA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x16c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x16c], 0
jne 0x5c40ca
push str.WinAPITable__GetModuleFileNameExA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.GetLogicalDriveStringsA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x170], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x170], 0
jne 0x5c410c
push str.WinAPITable__GetLogicalDriveStringsA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b25ec
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x174], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x174], 0
jne 0x5c4150
push str.WinAPITable__GetModuleFileNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b262c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x14], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x14], 0
jne 0x5c418c
push str.WinAPITable__IsDebuggerPresent_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b266c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x18], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x18], 0
jne 0x5c41ca
push str.WinAPITable__Sleep_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2694
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x10c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x10c], 0
jne 0x5c420c
push str.WinAPITable__NtQueryInformationThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b26e4
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x28], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x28], 0
jne 0x5c424a
push str.WinAPITable__NtQuerySystemInformation_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2734
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2c], 0
jne 0x5c4286
push str.WinAPITable__NtDuplicateObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2774
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x30], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x30], 0
jne 0x5c42c4
push str.WinAPITable__NtClose_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b279c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x94], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x94], 0
jne 0x5c4306
push str.WinAPITable__NtGetContextThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b27dc
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x98], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x98], 0
jne 0x5c434a
push str.WinAPITable__NtSetContextThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b281c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x9c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x9c], 0
jne 0x5c438c
push str.WinAPITable__NtReadVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b285c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xa0], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0xa0], 0
jne 0x5c43d0
push str.WinAPITable__NtWaitForSingleObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b28a4
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0xa4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0xa4], 0
jne 0x5c4412
push str.WinAPITable__NtUnmapViewOfSection_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b28ec
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xa8], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0xa8], 0
jne 0x5c4456
push str.WinAPITable__NtWriteVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2934
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0xb4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0xb4], 0
jne 0x5c4498
push str.WinAPITable__NtResumeThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtTerminateProcess
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x100], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x100], 0
jne 0x5c44dc
push str.WinAPITable__NtTerminateProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b29ac
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x104], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x104], 0
jne 0x5c451e
push str.WinAPITable__RtlAdjustPrivilege_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b29ec
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x108], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x108], 0
jne 0x5c4562
push str.WinAPITable__NtQueryInformationProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.ZwSetInformationThread
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x110], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x110], 0
jne 0x5c45a4
push str.WinAPITable__ZwSetInformationThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2a84
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x114], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x114], 0
jne 0x5c45e8
push str.WinAPITable__NtQueryVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2acc
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x118], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x118], 0
jne 0x5c462a
push str.WinAPITable__NtAdjustPrivilegesToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2b14
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x11c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x11c], 0
jne 0x5c466e
push str.WinAPITable__NtOpenProcessToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2b54
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x120], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x120], 0
jne 0x5c46b0
push str.WinAPITable__RtlGetVersion_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
call fcn.005a7310
movzx ecx, al
test ecx, ecx
je 0x5c4700
push str.SetProcessMitigationPolicy
mov edx, dword [0x7fe88c]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x124], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x124], 0
jne 0x5c4700
push str.WinAPITable__SetProcessMitigationPolicy_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
call fcn.005c6b10
movzx eax, al
test eax, eax
je 0x5c4750
push str.CsrGetProcessId
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x128], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x128], 0
jne 0x5c4750
push str.WinAPITable__CsrGetProcessId_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtSetInformationDebugObject
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x12c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x12c], 0
jne 0x5c4792
push str.WinAPITable__NtSetInformationDebugObject_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtRemoveProcessDebug
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x130], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x130], 0
jne 0x5c47d6
push str.WinAPITable__NtRemoveProcessDebug_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtSuspendProcess
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x134], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x134], 0
jne 0x5c4818
push str.WinAPITable__NtSuspendProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtResumeProcess
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x138], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x138], 0
jne 0x5c485c
push str.WinAPITable__NtResumeProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.RtlInitUnicodeString
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x148], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x148], 0
jne 0x5c489e
push str.WinAPITable__RtlInitUnicodeString_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.LdrLoadDll
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x13c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x13c], 0
jne 0x5c48e2
push str.WinAPITable__LdrLoadDll_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2d9c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x144], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x144], 0
jne 0x5c4924
push str.WinAPITable__CreateThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2dd4
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x188], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x188], 0
jne 0x5c4968
push str.WinAPITable__FindWindowExA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2e0c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x18c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x18c], 0
jne 0x5c49aa
push str.WinAPITable__GetWindowThreadProcessId_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2e5c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x190], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x190], 0
jne 0x5c49ee
push str.WinAPITable__GetClassNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2e94
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x194], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x194], 0
jne 0x5c4a30
push str.WinAPITable__GetWindowTextA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.GetWindowsDirectoryA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x198], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x198], 0
jne 0x5c4a74
push str.WinAPITable__GetWindowsDirectoryA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2f14
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1a0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1a0], 0
jne 0x5c4ab6
push str.WinAPITable__CreateToolhelp32Snapshot_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2f64
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1a4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1a4], 0
jne 0x5c4afa
push str.WinAPITable__Process32First_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2f9c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1a8], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1a8], 0
jne 0x5c4b3c
push str.WinAPITable__Process32Next_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b2fd4
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1ac], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1ac], 0
jne 0x5c4b80
push str.WinAPITable__Module32First_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b300c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1b0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1b0], 0
jne 0x5c4bc2
push str.WinAPITable__Module32Next_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1bc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1bc], 0
jne 0x5c4c06
push str.WinAPITable__ConvertStringSecurityDescriptorToSecurityDescriptorA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.SetKernelObjectSecurity
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1c0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1c0], 0
jne 0x5c4c48
push str.WinAPITable__SetKernelObjectSecurity_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.AllocateAndInitializeSid
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1cc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1cc], 0
jne 0x5c4c8c
push str.WinAPITable__AllocateAndInitializeSid_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.NtSetInformationProcess
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1d0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1d0], 0
jne 0x5c4cce
push str.WinAPITable__NtSetInformationProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push 0x6b31b0
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1d4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1d4], 0
jne 0x5c4d12
push str.WinAPITable__NtAllocateVirtualMemory_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x5c6ae8
push str.lstrcmpiA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1c], 0
jne 0x5c4d41
mov dword [ebp - 4], 4
push 0x6b3204
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2fc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2fc], 0
jne 0x5c4d78
mov dword [ebp - 4], 9
push str.CheckRemoteDebuggerPresent
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2f8], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2f8], 0
jne 0x5c4dad
mov dword [ebp - 4], 0x15
push 0x6b3234
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1d8], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1d8], 0
jne 0x5c4de4
mov dword [ebp - 4], 0x17
push 0x6b3248
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x30c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x30c], 0
jne 0x5c4e19
mov dword [ebp - 4], 0x18
push 0x6b3254
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xe4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0xe4], 0
jne 0x5c4e50
mov dword [ebp - 4], 0x19
push 0x6b3264
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x3c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x3c], 0
jne 0x5c4e7f
mov dword [ebp - 4], 0x24
push 0x6b3270
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x10], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x10], 0
jne 0x5c4eb0
mov dword [ebp - 4], 0x26
push 0x6b3284
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1c4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1c4], 0
jne 0x5c4ee5
mov dword [ebp - 4], 0x27
push 0x6b3298
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1c8], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1c8], 0
jne 0x5c4f1c
mov dword [ebp - 4], 0x28
push str.EnumDeviceDrivers
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0xc4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0xc4], 0
jne 0x5c4f51
mov dword [ebp - 4], 0x2b
push 0x6b32bc
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2e0], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2e0], 0
jne 0x5c4f88
mov dword [ebp - 4], 0x2c
push 0x6b32cc
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x238], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x238], 0
jne 0x5c4fbd
mov dword [ebp - 4], 0x2d
push 0x6b32d8
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1e8], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1e8], 0
jne 0x5c4ff4
mov dword [ebp - 4], 0x2e
push 0x6b32e8
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x26c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x26c], 0
jne 0x5c5029
mov dword [ebp - 4], 0x30
push 0x6b32f8
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x234], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x234], 0
jne 0x5c5060
mov dword [ebp - 4], 0x32
push str.CallNextHookEx
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0xac], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0xac], 0
jne 0x5c5095
mov dword [ebp - 4], 0x33
push str.SetWindowsHookExA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xb0], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0xb0], 0
jne 0x5c50cc
mov dword [ebp - 4], 0x34
push str.AddVectoredExceptionHandler
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x5c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x5c], 0
jne 0x5c50fb
mov dword [ebp - 4], 0x36
push str.VirtualQuery
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0xdc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0xdc], 0
jne 0x5c5132
mov dword [ebp - 4], 0x37
push str.MessageBoxTimeoutA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x270], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x270], 0
jne 0x5c5167
mov dword [ebp - 4], 0x38
push 0x6b336c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x160], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x160], 0
jne 0x5c519e
mov dword [ebp - 4], 0x3e
push str.CreateProcessA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x140], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x140], 0
jne 0x5c51d3
mov dword [ebp - 4], 0x3f
push 0x6b3390
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x304], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x304], 0
jne 0x5c520a
mov dword [ebp - 4], 0x40
push 0x6b33a0
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x274], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x274], 0
jne 0x5c523f
mov dword [ebp - 4], 0x42
push 0x6b33b0
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2ec], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2ec], 0
jne 0x5c5276
mov dword [ebp - 4], 0x44
push str.GetModuleInformation
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x24c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x24c], 0
jne 0x5c52ab
mov dword [ebp - 4], 0x45
push str.GetMappedFileNameA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x200], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x200], 0
jne 0x5c52e2
mov dword [ebp - 4], 0x46
push 0x6b33f0
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2d0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2d0], 0
jne 0x5c5317
mov dword [ebp - 4], 0x48
push str.CallWindowProcA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2e8], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2e8], 0
jne 0x5c534e
mov dword [ebp - 4], 0x4b
push str.IsWindowVisible
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x244], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x244], 0
jne 0x5c5383
mov dword [ebp - 4], 0x4e
push 0x6b341c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2f4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2f4], 0
jne 0x5c53ba
mov dword [ebp - 4], 0x51
push str.Thread32First
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x204], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x204], 0
jne 0x5c53ef
mov dword [ebp - 4], 0x52
push str.Thread32Next
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x208], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x208], 0
jne 0x5c5426
mov dword [ebp - 4], 0x53
push str.NtQueryObject
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x308], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x308], 0
jne 0x5c545b
mov dword [ebp - 4], 0x56
push 0x6b345c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x254], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x254], 0
jne 0x5c5492
mov dword [ebp - 4], 0x57
push str.FindFirstFileA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x290], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x290], 0
jne 0x5c54c7
mov dword [ebp - 4], 0x58
push str.FindNextFileA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x294], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x294], 0
jne 0x5c54fe
mov dword [ebp - 4], 0x59
push 0x6b3488
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x298], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x298], 0
jne 0x5c5533
mov dword [ebp - 4], 0x5a
push str.RemoveDirectoryA
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x29c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x29c], 0
jne 0x5c556a
mov dword [ebp - 4], 0x5b
push 0x6b34b0
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2a0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2a0], 0
jne 0x5c559f
mov dword [ebp - 4], 0x5c
push 0x6b34bc
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x28c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x28c], 0
jne 0x5c55d6
mov dword [ebp - 4], 0x5d
push str.FindClose
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2a4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2a4], 0
jne 0x5c560b
mov dword [ebp - 4], 0x5e
push 0x6b34dc
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1dc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1dc], 0
jne 0x5c5642
mov dword [ebp - 4], 0x5f
push 0x6b34f4
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1e0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1e0], 0
jne 0x5c5677
mov dword [ebp - 4], 0x60
push 0x6b350c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x1e4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x1e4], 0
jne 0x5c56ae
mov dword [ebp - 4], 0x61
push str.WNetGetProviderNameA
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x4c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x4c], 0
jne 0x5c56dd
mov dword [ebp - 4], 0x64
push 0x6b3538
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x250], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x250], 0
jne 0x5c5714
mov dword [ebp - 4], 0x6a
push str.GetTokenInformation
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1f8], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1f8], 0
jne 0x5c5749
mov dword [ebp - 4], 0x6c
push 0x6b3560
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x19c], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x19c], 0
jne 0x5c5780
mov dword [ebp - 4], 0x6d
push 0x6b356c
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x20c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x20c], 0
jne 0x5c57b5
mov dword [ebp - 4], 0x6e
push str.AddAccessDeniedAce
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x218], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x218], 0
jne 0x5c57ec
mov dword [ebp - 4], 0x6f
push str.AddAccessAllowedAce
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x21c], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x21c], 0
jne 0x5c5821
mov dword [ebp - 4], 0x70
push 0x6b35a4
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x220], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x220], 0
jne 0x5c5858
mov dword [ebp - 4], 0x71
push str.FreeSid
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x1f4], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x1f4], 0
jne 0x5c588d
mov dword [ebp - 4], 0x72
push str.SetThreadContext
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x284], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x284], 0
jne 0x5c58c4
mov dword [ebp - 4], 0x77
push str.SuspendThread
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0xb8], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0xb8], 0
jne 0x5c58f9
mov dword [ebp - 4], 0x78
push str.BlockInput
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x278], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x278], 0
jne 0x5c5930
mov dword [ebp - 4], 0x7a
push str.RemoveVectoredExceptionHandler
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x50], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x50], 0
jne 0x5c595f
mov dword [ebp - 4], 0x7c
push 0x6b360c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2bc], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2bc], 0
jne 0x5c5996
mov dword [ebp - 4], 0x7f
push 0x6b3618
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2c0], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2c0], 0
jne 0x5c59cb
mov dword [ebp - 4], 0x80
push 0x6b362c
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x2c4], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x2c4], 0
jne 0x5c5a02
mov dword [ebp - 4], 0x81
push str.UnhookWindowsHookEx
mov eax, dword [0x7fe88c]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7fe890]
mov dword [edx + 0x2c8], eax
mov eax, dword [0x7fe890]
cmp dword [eax + 0x2c8], 0
jne 0x5c5a37
mov dword [ebp - 4], 0x82
push str.EndTask
mov ecx, dword [0x7fe88c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x7fe890]
mov dword [ecx + 0x240], eax
mov edx, dword [0x7fe890]
cmp dword [edx + 0x240], 0
jne 0x5c5a6e
mov esp, ebp
pop ebp
ret