Function at 0x10018270
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2010
call fcn.10017520
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x20]
push str.Initializing_Decryptor...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x1020]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0x800
lea eax, [esp + 0x1028]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x1020]
push eax
push dword [esi]
call fcn.10001660
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Initializing_MinHook...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor esi, esi
mov ecx, 1
mov ebx, 0x100276c0
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x100183b7
cmp esi, 0x20
jae 0x1001839e
push 0
jmp 0x100183a0
push 1
call eax
inc esi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x10018395
cmp dword [0x100276c4], 0
jne 0x100183d1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100276c4], eax
xor eax, eax
xchg dword [ebx], eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Hooking_all_required_functions...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
xor edi, edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebx + 0x3c]
mov ebp, dword [eax + ebx + 0x78]
mov esi, dword [ebp + ebx + 0x20]
add esi, ebx
nop
mov ecx, dword [esi]
mov edx, 0xda35e908
add ecx, ebx
mov al, byte [ecx]
inc ecx
test al, al
je 0x1001849d
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x10018480
cmp edx, 0x46d28c80
je 0x100184a3
inc edi
add esi, 4
jmp 0x10018470
mov eax, dword [ebp + ebx + 0x24]
mov edx, 0x1001ac50
push dword [esp + 0x1c]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [ebp + ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + ebx]
add edi, ebx
mov ecx, edi
call fcn.10002a95
mov ebx, eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
test ebx, ebx
je 0x1001870c
push 0x10022b08
push str._____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, ebx
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 0x10022234
lea eax, [esp + 0x1034]
push eax
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.10001680
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018649
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018649
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5e35e581
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10018645
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10018628
cmp esi, 0xf9f9e964
je 0x1001864d
test edi, edi
jne 0x10018613
mov eax, dword [eax]
jmp 0x100185f0
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x10018562
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x100186e9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100186e9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x100186e5
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100186c8
cmp esi, 0x2a789c24
je 0x100186ed
test edi, edi
jne 0x100186b3
mov eax, dword [eax]
jmp 0x10018690
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
jmp 0x1001876a
push 0x10022bb0
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, edi
cdq
push edx
push eax
push str.NtCreateFile
lea eax, [esp + 0x102c]
push eax
push 0x800
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10001680
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
xor edi, edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebx + 0x3c]
mov ebp, dword [eax + ebx + 0x78]
mov esi, dword [ebp + ebx + 0x20]
add esi, ebx
nop word [eax + eax]
mov ecx, dword [esi]
mov edx, 0x4f38dfce
add ecx, ebx
mov al, byte [ecx]
inc ecx
test al, al
je 0x100187bd
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x100187a0
cmp edx, 0xd94e7b86
je 0x100187c3
inc edi
add esi, 4
jmp 0x10018790
mov eax, dword [ebp + ebx + 0x24]
mov edx, 0x1001a680
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [ebp + ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + ebx]
mov eax, dword [esp + 0x1c]
add edi, ebx
add eax, 8
mov ecx, edi
push eax
call fcn.10002a95
mov ebx, eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
test ebx, ebx
je 0x10018a34
push 0x10022c38
push str._____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, ebx
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 0x10022c1c
lea eax, [esp + 0x1034]
push eax
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.10001680
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018971
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018971
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5e35e581
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1001896d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10018950
cmp esi, 0xf9f9e964
je 0x10018975
test edi, edi
jne 0x10018936
mov eax, dword [eax]
jmp 0x10018913
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x10018886
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018a11
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018a11
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10018a0d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100189f0
cmp esi, 0x2a789c24
je 0x10018a15
test edi, edi
jne 0x100189d6
mov eax, dword [eax]
jmp 0x100189b3
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
jmp 0x10018a92
push 0x10022cd8
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, edi
cdq
push edx
push eax
push str.NtReadFile
lea eax, [esp + 0x102c]
push eax
push 0x800
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10001680
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
xor edi, edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebx + 0x3c]
mov ebp, dword [eax + ebx + 0x78]
mov esi, dword [ebp + ebx + 0x20]
add esi, ebx
mov ecx, dword [esi]
mov edx, 0x543b2644
add ecx, ebx
mov al, byte [ecx]
inc ecx
test al, al
je 0x10018adf
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x10018ac2
cmp edx, 0xb2205e35
je 0x10018ae5
inc edi
add esi, 4
jmp 0x10018ab2
mov eax, dword [ebp + ebx + 0x24]
mov edx, 0x1001a2b0
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [ebp + ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + ebx]
mov eax, dword [esp + 0x1c]
add edi, ebx
add eax, 0x10
mov ecx, edi
push eax
call fcn.10002a95
mov ebx, eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
test ebx, ebx
je 0x10018d54
push 0x10022d48
push str._____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, ebx
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 0x100229d4
lea eax, [esp + 0x1034]
push eax
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.10001680
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018c91
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018c91
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5e35e581
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10018c8d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10018c70
cmp esi, 0xf9f9e964
je 0x10018c95
test edi, edi
jne 0x10018c58
mov eax, dword [eax]
jmp 0x10018c35
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x10018ba8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018d31
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018d31
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10018d2d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10018d10
cmp esi, 0x2a789c24
je 0x10018d35
test edi, edi
jne 0x10018cf6
mov eax, dword [eax]
jmp 0x10018cd3
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
jmp 0x10018db2
push 0x10022dd0
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, edi
cdq
push edx
push eax
push str.NtCreateSection
lea eax, [esp + 0x102c]
push eax
push 0x800
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10001680
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
xor edi, edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebx + 0x3c]
mov ebp, dword [eax + ebx + 0x78]
mov esi, dword [ebp + ebx + 0x20]
add esi, ebx
mov ecx, dword [esi]
mov edx, 0x10bf2bf9
add ecx, ebx
mov al, byte [ecx]
inc ecx
test al, al
je 0x10018dff
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x10018de2
cmp edx, 0xbac732f2
je 0x10018e05
inc edi
add esi, 4
jmp 0x10018dd2
mov eax, dword [ebp + ebx + 0x24]
mov edx, 0x10019d40
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [ebp + ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + ebx]
mov eax, dword [esp + 0x1c]
add edi, ebx
add eax, 0x18
mov ecx, edi
push eax
call fcn.10002a95
mov ebx, eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
test ebx, ebx
je 0x10019074
push 0x10022e68
push str._____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, ebx
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 0x10022e3c
lea eax, [esp + 0x1034]
push eax
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.10001680
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10018fb1
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10018fb1
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5e35e581
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10018fad
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10018f90
cmp esi, 0xf9f9e964
je 0x10018fb5
test edi, edi
jne 0x10018f78
mov eax, dword [eax]
jmp 0x10018f55
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x10018ec8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10019051
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10019051
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1001904d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10019030
cmp esi, 0x2a789c24
je 0x10019055
test edi, edi
jne 0x10019016
mov eax, dword [eax]
jmp 0x10018ff3
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
jmp 0x100190d2
push 0x10022f18
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, edi
cdq
push edx
push eax
push str.NtMapViewOfSection
lea eax, [esp + 0x102c]
push eax
push 0x800
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10001680
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
xor edi, edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov eax, dword [ebx + 0x3c]
mov ebp, dword [eax + ebx + 0x78]
mov esi, dword [ebp + ebx + 0x20]
add esi, ebx
mov ecx, dword [esi]
mov edx, 0x845203a5
add ecx, ebx
mov al, byte [ecx]
inc ecx
test al, al
je 0x1001911f
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x10019102
cmp edx, 0x74c37765
je 0x10019125
inc edi
add esi, 4
jmp 0x100190f2
mov eax, dword [ebp + ebx + 0x24]
mov edx, 0x100197a0
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [ebp + ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + ebx]
mov eax, dword [esp + 0x1c]
add edi, ebx
add eax, 0x20
mov ecx, edi
push eax
call fcn.10002a95
mov ebx, eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
test ebx, ebx
je 0x10019394
push str.Failed_to_hook_function__ls__address:_0x_llX__status:__llu
push str._____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, ebx
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 0x10022f84
lea eax, [esp + 0x1034]
push eax
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.10001680
add esp, 0x24
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x100192d1
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100192d1
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5e35e581
mov cl, byte [edx]
inc edx
test cl, cl
je 0x100192cd
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100192b0
cmp esi, 0xf9f9e964
je 0x100192d5
test edi, edi
jne 0x10019298
mov eax, dword [eax]
jmp 0x10019275
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x100191e8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10019371
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10019371
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1001936d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10019350
cmp esi, 0x2a789c24
je 0x10019375
test edi, edi
jne 0x10019336
mov eax, dword [eax]
jmp 0x10019313
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
jmp 0x100193f2
push str.Successfully_hooked_function__ls__address:_0x_llX
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, edi
cdq
push edx
push eax
push str.NtClose
lea eax, [esp + 0x102c]
push eax
push 0x800
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10001680
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Enabling_all_hooked_functions...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor esi, esi
mov ecx, 1
xor eax, eax
mov ebx, 0x100276c0
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x100194a4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x10019490
push 0
jmp 0x10019492
push 1
call edi
inc esi
mov edx, 1
xor eax, eax
lock cmpxchg dword [ebx], edx
test eax, eax
jne 0x10019487
cmp dword [0x100276c4], 0
je 0x100194c5
mov ecx, 1
call fcn.100029ba
xor ecx, ecx
xchg dword [ebx], ecx
test eax, eax
je 0x100196f2
jmp 0x100194c9
xor eax, eax
xchg dword [ebx], eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Failed_to_enable_all_hooked_functions__exiting...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Exiting_in__d...
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
mov eax, 0xa
sub eax, ebx
push eax
lea eax, [esp + 0x1024]
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x10019631
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10019631
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, ebp
dec edi
mov esi, 0x5e35e581
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x1001962d
nop dword [eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10019610
cmp esi, 0xf9f9e964
je 0x10019635
test edi, edi
jne 0x100195f8
mov eax, dword [eax]
jmp 0x100195d5
mov edx, dword [esp + 0x14]
push 0x3e8
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0xa
jb 0x10019548
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 0x18]
mov ecx, dword [ebp + 0x3c]
mov ecx, dword [ecx + ebp + 0x78]
add ecx, ebp
mov dword [esp + 0x14], ecx
cmp ecx, ebp
je 0x100196d1
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100196d1
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, ebp
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, ebp
dec edi
mov esi, 0x5d33a557
mov cl, byte [edx]
inc edx
test cl, cl
je 0x100196cd
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100196b0
cmp esi, 0x2a789c24
je 0x100196d5
test edi, edi
jne 0x10019696
mov eax, dword [eax]
jmp 0x10019673
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + ebp]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebp]
add eax, ebp
call eax
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
mov ebx, dword [edi + 0x10023330]
test ebx, ebx
je 0x10019788
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1024]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push str.Encrypted_String:__ls
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1020]
push ebx
push eax
push 0x800
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x20]
push eax
push dword [esi]
call fcn.10001660
add edi, 4
cmp edi, 0x400
jb 0x10019700
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret