Function at 0x12d8ec40
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x130560bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov eax, dword [esp + 0x66c]
mov ecx, dword [esp + 0x670]
push ebx
push ebp
push esi
push edi
mov dword [0x13196cc8], eax
mov dword [0x13196cc4], ecx
xor ebp, ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x466]
mov word [esp + 0x464], bp
lea edx, [esp + 0x464]
rep stosd dword es:[edi], eax
push 0x104
push edx
push ebp
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x12d91484
push 0x104
lea eax, [esp + 0x468]
push 0x13196cd4
push eax
call fcn.12e37140
mov eax, dword [0x13198f68]
add esp, 0xc
or edi, 0xffffffff
cmp eax, ebp
je 0x12d8ecee
push 0x13196cd4
push str.Path__s_
push 0x130c6b6c
push edi
call fcn.12dad750
add esp, 0x10
push 0x104
push 0x13196cd4
push 0x13196ee4
call fcn.12f5c4ab
push 0x5c
push 0x13196ee4
mov dword [0x13196ee0], 0x13196ee4
call fcn.12f5c8b4
add esp, 0x14
cmp eax, ebp
mov dword [0x13196edc], eax
jne 0x12d8ed2b
xor eax, eax
jmp 0x12d91484
add eax, 2
push 0x13196cd4
mov dword [0x13196edc], eax
call fcn.12f614f4
push 0x5c
push 0x13196cd4
mov dword [0x13196cd0], 0x13196cd4
call fcn.12f5c8b4
add esp, 0xc
cmp eax, ebp
mov dword [0x13196ccc], eax
jne 0x12d8ed66
xor eax, eax
jmp 0x12d91484
add eax, 2
push str.360chrome.exe
push eax
mov dword [0x13196ccc], eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8ed8f
mov eax, 0x1a
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.360chromex.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8edb5
mov eax, 0x28
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.115chrome.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8eddb
mov eax, 0x15
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.2345explorer.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8ee01
mov eax, 0x16
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.coral.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8ee27
mov eax, 0x18
mov dword [0x13197708], eax
jmp 0x12d90f61
mov ecx, dword [0x13196ccc]
push 0x130c6ac4
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8ee4e
mov eax, 0x1f
mov dword [0x13197708], eax
jmp 0x12d90f61
mov edx, dword [0x13196ccc]
push 0x130c6aac
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8ee75
mov eax, 0x29
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.sogouexplorer.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8ee9b
mov eax, 0x20
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push 0x130c6a6c
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f04a
mov eax, dword [0x1307d25c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x674], ebp
mov dword [esp + 0x30], eax
mov byte [esp + 0x674], 1
mov dword [esp + 0x34], eax
mov byte [esp + 0x674], 2
mov dword [esp + 0x38], eax
mov byte [esp + 0x674], 3
mov dword [esp + 0x3c], eax
mov byte [esp + 0x674], 4
mov dword [esp + 0x40], eax
mov byte [esp + 0x674], 5
mov dword [esp + 0x44], eax
mov byte [esp + 0x674], 6
mov dword [esp + 0x48], eax
mov byte [esp + 0x674], 7
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ebx, 8
push 0x13196cd4
lea ecx, [esp + 0x18]
mov dword [esp + 0x678], ebx
call fcn.12f41740
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ebp
push ecx
push edx
mov byte [esp + 0x680], 9
call fcn.12f72010
mov eax, dword [esp + 0x44]
push 0x103
push eax
push 0x131970ec
call fcn.12f5c4ab
push 0x131970ec
call fcn.12f5c44d
add esp, 0x1c
test eax, eax
je 0x12d8efa1
push str.explorer
push 0x131970ec
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8efab
mov dword [0x13197708], 0x100300
lea ecx, [esp + 0x14]
mov byte [esp + 0x674], bl
call fcn.12f41ea0
lea ecx, [esp + 0x48]
mov dword [esp + 0x674], 0x10
call fcn.12f47220
lea ecx, [esp + 0x44]
mov byte [esp + 0x674], 0xf
call fcn.12f47220
lea ecx, [esp + 0x40]
mov byte [esp + 0x674], 0xe
call fcn.12f47220
lea ecx, [esp + 0x3c]
mov byte [esp + 0x674], 0xd
call fcn.12f47220
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0xc
call fcn.12f47220
lea ecx, [esp + 0x34]
mov byte [esp + 0x674], 0xb
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x674], 0xa
call fcn.12f47220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x674], edi
call fcn.12f47220
jmp 0x12d900df
mov eax, dword [0x13196ccc]
push 0x130c6a3c
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f1fd
mov eax, dword [0x1307d25c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x674], 0x12
mov dword [esp + 0x30], eax
mov byte [esp + 0x674], 0x13
mov dword [esp + 0x34], eax
mov byte [esp + 0x674], 0x14
mov dword [esp + 0x38], eax
mov byte [esp + 0x674], 0x15
mov dword [esp + 0x3c], eax
mov byte [esp + 0x674], 0x16
mov dword [esp + 0x40], eax
mov byte [esp + 0x674], 0x17
mov dword [esp + 0x44], eax
mov byte [esp + 0x674], 0x18
mov dword [esp + 0x48], eax
mov byte [esp + 0x674], 0x19
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
push 0x13196cd4
lea ecx, [esp + 0x18]
mov dword [esp + 0x678], 0x1a
call fcn.12f41740
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ebp
push ecx
push edx
mov byte [esp + 0x680], 0x1b
call fcn.12f72010
mov eax, dword [esp + 0x44]
push 0x103
push eax
push 0x131970ec
call fcn.12f5c4ab
push 0x131970ec
call fcn.12f5c44d
add esp, 0x1c
test eax, eax
je 0x12d8f153
push str.rundll
push 0x131970ec
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8f15d
mov dword [0x13197708], 0x2b
lea ecx, [esp + 0x14]
mov byte [esp + 0x674], 0x1a
call fcn.12f41ea0
lea ecx, [esp + 0x48]
mov dword [esp + 0x674], 0x22
call fcn.12f47220
lea ecx, [esp + 0x44]
mov byte [esp + 0x674], 0x21
call fcn.12f47220
lea ecx, [esp + 0x40]
mov byte [esp + 0x674], 0x20
call fcn.12f47220
lea ecx, [esp + 0x3c]
mov byte [esp + 0x674], 0x1f
call fcn.12f47220
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0x1e
call fcn.12f47220
lea ecx, [esp + 0x34]
mov byte [esp + 0x674], 0x1d
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x674], 0x1c
call fcn.12f47220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x674], edi
call fcn.12f47220
jmp 0x12d900df
mov eax, dword [0x13196ccc]
push str.openwith.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f3ac
mov eax, dword [0x1307d25c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x674], 0x24
mov dword [esp + 0x30], eax
mov byte [esp + 0x674], 0x25
mov dword [esp + 0x34], eax
mov byte [esp + 0x674], 0x26
mov dword [esp + 0x38], eax
mov byte [esp + 0x674], 0x27
mov dword [esp + 0x3c], eax
mov byte [esp + 0x674], 0x28
mov dword [esp + 0x40], eax
mov byte [esp + 0x674], 0x29
mov dword [esp + 0x44], eax
mov byte [esp + 0x674], 0x2a
mov dword [esp + 0x48], eax
mov byte [esp + 0x674], 0x2b
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ebx, 0x2c
push 0x13196cd4
lea ecx, [esp + 0x18]
mov dword [esp + 0x678], ebx
call fcn.12f41740
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ebp
push ecx
push edx
mov byte [esp + 0x680], 0x2d
call fcn.12f72010
mov eax, dword [esp + 0x44]
push 0x103
push eax
push 0x131970ec
call fcn.12f5c4ab
push 0x131970ec
call fcn.12f5c44d
add esp, 0x1c
test eax, eax
je 0x12d8f307
push str.openwith
push 0x131970ec
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d8f30d
mov dword [0x13197708], ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x674], bl
call fcn.12f41ea0
lea ecx, [esp + 0x48]
mov dword [esp + 0x674], 0x34
call fcn.12f47220
lea ecx, [esp + 0x44]
mov byte [esp + 0x674], 0x33
call fcn.12f47220
lea ecx, [esp + 0x40]
mov byte [esp + 0x674], 0x32
call fcn.12f47220
lea ecx, [esp + 0x3c]
mov byte [esp + 0x674], 0x31
call fcn.12f47220
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0x30
call fcn.12f47220
lea ecx, [esp + 0x34]
mov byte [esp + 0x674], 0x2f
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x674], 0x2e
call fcn.12f47220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x674], edi
call fcn.12f47220
jmp 0x12d900df
mov eax, dword [0x13196ccc]
push 0x130c69e4
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f3d2
mov dword [0x13197708], 0x110000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.totalcmd.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f3f8
mov dword [0x13197708], 0x100e00
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push 0x130c69b8
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c1b
mov eax, dword [0x13196ccc]
push str.ntvdm.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c1b
mov eax, dword [0x13196ccc]
push str.powershell.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f454
mov dword [0x13197708], 0x150000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.winword.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c0c
mov eax, dword [0x13196ccc]
push str.excel.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c0c
mov eax, dword [0x13196ccc]
push str.msaccess.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c0c
mov eax, dword [0x13196ccc]
push str.powerpnt.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90c0c
mov ecx, dword [0x13196ccc]
push str.wpp.exe
push ecx
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bfd
mov edx, dword [0x13196ccc]
push str.et.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bfd
mov eax, dword [0x13196ccc]
push 0x130c68f0
push eax
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bfd
mov ecx, dword [0x13196ccc]
push str.wpspdf.exe
push ecx
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bfd
mov edx, dword [0x13196ccc]
push str.dxp.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8f556
mov dword [0x13197708], 0x220000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.aclt.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f593
mov eax, dword [0x13196cd0]
push str.autocad_lt_2002
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f593
mov dword [0x13197708], 0x100800
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.winrar.exe
push eax
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8f5b9
mov dword [0x13197708], 0x100a00
jmp 0x12d90fa6
mov ecx, dword [0x13196ccc]
push str.7zg.exe
push ecx
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bee
mov edx, dword [0x13196ccc]
push str.7zfm.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bee
mov eax, dword [0x13196ccc]
push str.7z.exe
push eax
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90bee
mov ecx, dword [0x13196ccc]
push str.haozip.exe
push ecx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8f633
mov dword [0x13197708], 0x100a02
jmp 0x12d90fa6
mov edx, dword [0x13196ccc]
push str.kuaizip.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8f65a
mov dword [0x13197708], 0x100a03
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.spoolsv.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f680
mov dword [0x13197708], 0x100900
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.svchost.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f6d4
mov dword [0x13197708], 0x100b00
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebp
je 0x12d900df
push str.ClipboardSvcGroup
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d900df
mov dword [0x13197708], 0x100b01
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.screensketch.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f6fa
mov dword [0x13197708], 0x32
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.snippingtool.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f720
mov dword [0x13197708], 0x33
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.wcesmgr.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f746
mov dword [0x13197708], 0x100c00
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.nero.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bdf
mov eax, dword [0x13196ccc]
push str.neroexpress.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bdf
mov eax, dword [0x13196ccc]
push str.dtmaster.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f7a2
mov dword [0x13197708], 0x100f00
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.spdevdrv.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f7c8
mov dword [0x13197708], 0x101000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.roxio_central33.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f7ee
mov dword [0x13197708], 0x102000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.pickerhost.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f814
mov dword [0x13197708], 0x1c
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.dataexchangehost.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f83a
mov dword [0x13197708], 0x1d
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.flashutil_activex.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f860
mov dword [0x13197708], 0x1e
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push eax
call fcn.12f5c44d
mov ecx, dword [0x13196ccc]
add esp, 4
cmp eax, 6
jne 0x12d8f8b4
cmp word [ecx], 0x71
jne 0x12d8f8b4
cmp word [ecx + 2], 0x71
jne 0x12d8f8b4
cmp word [ecx + 4], 0x2e
jne 0x12d8f8b4
mov eax, 0x65
cmp word [ecx + 6], ax
jne 0x12d8f8b4
cmp word [ecx + 8], 0x78
jne 0x12d8f8b4
cmp word [ecx + 0xa], ax
jne 0x12d8f8b4
mov dword [0x13197708], 0x103000
jmp 0x12d90fa6
push str.tm.exe
push ecx
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f8d5
mov dword [0x13197708], 0x104000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.notes.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bd0
mov eax, dword [0x13196ccc]
push 0x130c661c
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bd0
mov eax, dword [0x13196ccc]
push str.360zip.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f931
mov dword [0x13197708], 0x106000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.msnmsgr.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f957
mov dword [0x13197708], 0x107000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.iexplore.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fb27
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call fcn.12f9c7e0
test eax, eax
je 0x12d8f9a8
cmp esi, ebp
je 0x12d8f9a8
push str._ServerName:DefaultBrowserServer
push esi
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8f9a8
mov eax, 0x160000
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x1307d25c]
mov dword [0x13197708], 0x10c000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x674], 0x36
mov dword [esp + 0x30], eax
mov byte [esp + 0x674], 0x37
mov dword [esp + 0x34], eax
mov byte [esp + 0x674], 0x38
mov dword [esp + 0x38], eax
mov byte [esp + 0x674], 0x39
mov dword [esp + 0x3c], eax
mov byte [esp + 0x674], 0x3a
mov dword [esp + 0x40], eax
mov byte [esp + 0x674], 0x3b
mov dword [esp + 0x44], eax
mov byte [esp + 0x674], 0x3c
mov dword [esp + 0x48], eax
mov byte [esp + 0x674], 0x3d
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ebx, 0x3e
push 0x13196cd4
lea ecx, [esp + 0x18]
mov dword [esp + 0x678], ebx
call fcn.12f41740
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ebp
push ecx
push edx
mov byte [esp + 0x680], 0x3f
call fcn.12f72010
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [0x13197704], eax
and eax, 0xffff0000
cmp eax, 0xa0000
jb 0x12d8fa88
mov dword [0x13197718], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x674], bl
call fcn.12f41ea0
lea ecx, [esp + 0x48]
mov dword [esp + 0x674], 0x46
call fcn.12f47220
lea ecx, [esp + 0x44]
mov byte [esp + 0x674], 0x45
call fcn.12f47220
lea ecx, [esp + 0x40]
mov byte [esp + 0x674], 0x44
call fcn.12f47220
lea ecx, [esp + 0x3c]
mov byte [esp + 0x674], 0x43
call fcn.12f47220
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0x42
call fcn.12f47220
lea ecx, [esp + 0x34]
mov byte [esp + 0x674], 0x41
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x674], 0x40
call fcn.12f47220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x674], edi
call fcn.12f47220
jmp 0x12d900df
mov eax, dword [0x13196ccc]
push str.microsoftedge.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bc1
mov eax, dword [0x13196ccc]
push str.microsoftedgecp.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
jne 0x12d90bc1
mov eax, dword [0x13196ccc]
push str.360se.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fb83
mov eax, 0x108000
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.avant.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fba9
mov dword [0x13197708], 0x10a000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.opera.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fbcf
mov eax, 0x10d000
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.orca.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fbf5
mov eax, 0x10e000
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.hao123juzi.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fc1b
mov eax, 0x130000
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.conhost.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fc41
mov dword [0x13197708], 0x140000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.acad.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fc67
mov dword [0x13197708], 0x10f000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.ucbrowser.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fc8d
mov eax, 9
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push 0x130c6470
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fcb3
mov eax, 0x10
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.liebao.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fcd9
mov eax, 0x11
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.theworld.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fcff
mov eax, 0x12
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.qqbrowser.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fd25
mov eax, 0x13
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push 0x130c6408
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fd4b
mov eax, 0x14
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.baiduyunguanjia.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fd71
mov eax, 0x170000
mov dword [0x13197708], eax
jmp 0x12d90f87
mov eax, dword [0x13196ccc]
push str.baidunetdisk.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fd97
mov eax, 0x180000
mov dword [0x13197708], eax
jmp 0x12d90f87
mov eax, dword [0x13196ccc]
push str.115.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fdbd
mov eax, 0x2d0000
mov dword [0x13197708], eax
jmp 0x12d90f87
mov eax, dword [0x13196ccc]
push str.wydrive.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90bb2
mov ecx, dword [0x13196ccc]
push str.wyeiyunapp.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90bb2
mov eax, dword [0x13196ccc]
push str.qianying.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fe1a
mov eax, 0x17
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.SLBrowser.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fe40
mov eax, 0x2e
mov dword [0x13197708], eax
jmp 0x12d90f61
mov eax, dword [0x13196ccc]
push str.splwow64.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fe66
mov dword [0x13197708], 0x109000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.afterfx.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8fe8c
mov dword [0x13197708], 0x10b000
jmp 0x12d90fa6
mov edx, dword [0x13196ccc]
push str.ftp.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8feb3
mov dword [0x13197708], 0x120000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.ocewpd2dp.exe
push eax
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8fed9
mov dword [0x13197708], 0x1a0000
jmp 0x12d90fa6
mov ecx, dword [0x13196ccc]
push str.pscp.exe
push ecx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8ff00
mov dword [0x13197708], 0x19
jmp 0x12d90fa6
mov edx, dword [0x13196ccc]
push str.browser_broker.exe
push edx
call fcn.12f5cf5e
add esp, 8
test eax, eax
jne 0x12d8ff27
mov dword [0x13197708], 0x1b
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.oconsole3.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d8ff57
mov dword [0x13197724], 1
mov dword [0x13197708], 0x100101
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.dllhost.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d9009e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x56]
mov word [esp + 0x54], bp
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x58]
push eax
push str.DllHost.exe__Processid:76D0CB12_7604_4048_B83C_1005C7DDC503
call fcn.12d92290
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26a]
mov word [esp + 0x268], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x268]
push 0x104
push ecx
push str.DllHost.exe__Processid:72A7994A_3092_4054_B6BE_08FF81AEEFFC
stosw word es:[edi], ax
call fcn.12d92290
mov eax, dword [0x13198f68]
add esp, 0x18
cmp eax, ebp
je 0x12d90001
lea edx, [esp + 0x25c]
lea eax, [esp + 0x54]
push edx
push eax
push esi
push str.Cmdline__Cur:_s__TheDllhost:_s__NetShareDllhost:_s_
push 0x130c60fc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
cmp esi, ebp
je 0x12d900df
lea ecx, [esp + 0x54]
push ecx
call fcn.12f5c44d
add esp, 4
test eax, eax
jbe 0x12d90054
lea edx, [esp + 0x54]
push edx
push esi
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90054
mov eax, dword [0x13198f68]
mov dword [0x13197734], 1
cmp eax, ebp
je 0x12d900df
push str.Is_TheDllhost
push 0x130c60fc
push 0xffffffffffffffff
jmp 0x12d900d7
lea eax, [esp + 0x25c]
push eax
call fcn.12f5c44d
add esp, 4
test eax, eax
jbe 0x12d900df
lea ecx, [esp + 0x25c]
push ecx
push esi
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d900df
mov eax, dword [0x13198f68]
mov dword [0x13197738], 1
cmp eax, ebp
je 0x12d900df
push str.Is_UdiskShareDllhost
push str.udisk
push 0xffffffffffffffff
jmp 0x12d900d7
mov eax, dword [0x13196ccc]
push str.wlxphotogallery.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d9024f
mov eax, dword [0x13198f68]
mov dword [0x13197734], 1
cmp eax, ebp
je 0x12d900df
push str.Is_WLXPhotoGallery
push 0x130c60fc
push edi
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x13197708]
cmp eax, ebp
jne 0x12d90ee9
mov eax, dword [0x1307d25c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x674], 0x48
mov dword [esp + 0x30], eax
mov byte [esp + 0x674], 0x49
mov dword [esp + 0x34], eax
mov byte [esp + 0x674], 0x4a
mov dword [esp + 0x38], eax
mov byte [esp + 0x674], 0x4b
mov dword [esp + 0x3c], eax
mov byte [esp + 0x674], 0x4c
mov dword [esp + 0x40], eax
mov byte [esp + 0x674], 0x4d
mov dword [esp + 0x44], eax
mov byte [esp + 0x674], 0x4e
mov dword [esp + 0x48], eax
mov byte [esp + 0x674], 0x4f
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
push 0x13196cd4
lea ecx, [esp + 0x14]
mov dword [esp + 0x678], 0x50
call fcn.12f41740
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ebp
push ecx
push edx
mov byte [esp + 0x680], 0x51
call fcn.12f72010
add esp, 0xc
lea eax, [esp + 0x34]
lea ecx, [esp + 0x4c]
push eax
call fcn.12f46820
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0x52
push ecx
lea ecx, [esp + 0x18]
call fcn.12f46820
lea edx, [esp + 0x3c]
mov bl, 0x53
push edx
lea ecx, [esp + 0x54]
mov byte [esp + 0x678], bl
call fcn.12f46820
mov byte [esp + 0x674], 0x54
xor edi, edi
mov esi, 0x130c567c
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x12d90205
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d9023e
mov eax, dword [esi]
cmp eax, ebp
je 0x12d9021d
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d9023e
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x12d90c2a
mov edx, dword [esp + 0x50]
push eax
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90c2a
add esi, 0x10
inc edi
cmp esi, 0x130c569c
jb 0x12d901ec
jmp 0x12d90c38
mov eax, dword [0x13196ccc]
push str.vds.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d9028c
mov eax, dword [0x13198f68]
mov dword [0x1319773c], 1
cmp eax, ebp
je 0x12d900df
push str.Is_vds
push str.udisk
jmp 0x12d900d6
mov eax, dword [0x13196ccc]
push str.mstsc.exe
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d902b2
mov dword [0x13197708], 0x161000
jmp 0x12d90fa6
mov edx, dword [0x13196ccc]
push str.mailmaster.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d902d9
mov dword [0x13197708], 0x230000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push eax
push str.cp.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.mv.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.rm.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.mkdir.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.vim.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.sh.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.ls.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.cat.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.rvim.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.diff.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.unzip.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.gzip.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.funzip.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.unzipsfx.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.find.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.uniq.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.tar.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.bzip2.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.bunzip2.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.tac.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.less.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.head.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.tail.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.grep.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.sed.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.sort.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.paste.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.comm.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.echo.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push edx
push str.bash.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov eax, dword [0x13196ccc]
push eax
push str.vmtoolsd.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov ecx, dword [0x13196ccc]
push ecx
push str.touch.exe
call fcn.12f5cf5e
add esp, 8
test eax, eax
je 0x12d90ba3
mov edx, dword [0x13196ccc]
push str.360desktop.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90b94
mov eax, dword [0x13196ccc]
push str.360desktoplite64.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90b94
mov ecx, dword [0x13196ccc]
push str.adb.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d906ac
mov dword [0x13197708], 0x260000
jmp 0x12d90fa6
mov edx, dword [0x13196ccc]
push str.xshellcore.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d906d3
mov dword [0x13197708], 0x270000
jmp 0x12d90fa6
mov eax, dword [0x13196ccc]
push str.xshell.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d906f9
mov dword [0x13197708], 0x2b0000
jmp 0x12d90fa6
mov ecx, dword [0x13196ccc]
push str.skloader.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90b85
mov edx, dword [0x13196ccc]
push str.lewd.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90b85
mov dword [0x13197708], 0x21
jmp 0x12d90fa6
mov dword [0x13197708], 0x250000
jmp 0x12d90fa6
mov dword [0x13197708], 0x240000
jmp 0x12d90fa6
mov eax, 0x190000
mov dword [0x13197708], eax
jmp 0x12d90f87
mov dword [0x13197708], 0x200000
jmp 0x12d90fa6
mov dword [0x13197708], 0x105000
jmp 0x12d90fa6
mov dword [0x13197708], 0x100d00
jmp 0x12d90fa6
mov dword [0x13197708], 0x100a01
jmp 0x12d90fa6
mov dword [0x13197708], 0x210000
jmp 0x12d90fa6
mov dword [0x13197708], 0x100500
jmp 0x12d90fbe
mov dword [0x13197708], 0x100400
jmp 0x12d90fbe
shl edi, 4
mov eax, dword [edi + 0x130c5678]
mov dword [0x13197708], eax
mov ecx, dword [esp + 0x30]
push str.wechat
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90c58
mov dword [0x13197708], 0x310000
cmp dword [0x13197724], ebp
jne 0x12d90d76
mov edx, dword [esp + 0x30]
push 0x103
push edx
push 0x131972f4
call fcn.12f5c4ab
push 0x131972f4
call fcn.12f5c44d
add esp, 0x10
test eax, eax
je 0x12d90cdf
mov eax, dword [esp + 0x30]
push str.Ocular_Agent
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90cb5
mov ecx, dword [esp + 0x30]
push str.Ocular_Tool
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90cdf
mov eax, dword [0x13198f68]
mov esi, 1
cmp eax, ebp
mov dword [0x13197724], esi
je 0x12d90ce4
push str.CAppEnvir::Init_NeedOnlyHookCreateProc
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12d90ce4
mov esi, 1
mov edx, dword [esp + 0x38]
push str.Ocular_System
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90d1d
mov eax, dword [0x13198f68]
mov dword [0x13197724], esi
cmp eax, ebp
je 0x12d90d1d
push str.CAppEnvir::Init_NeedOnlyHookCreateProc_2
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x13196ccc]
push str.akernel3.exe
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90d6e
mov eax, dword [0x13196cd0]
push str.ipgaskernel
push eax
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d90d6e
mov eax, dword [0x13198f68]
mov dword [0x13197724], esi
cmp eax, ebp
je 0x12d90d76
push str.CAppEnvir::Init_NeedOnlyHookCreateProc_3
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
cmp dword [0x13197724], ebp
je 0x12d90df3
mov ecx, dword [0x13196ccc]
push str.UIHelper32.exe
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90da6
mov edx, dword [0x13196ccc]
push str.UIHelper64.exe
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90df3
push 0x131972f4
mov dword [0x13197724], ebp
call fcn.12f5c44d
add esp, 4
test eax, eax
je 0x12d90df3
push str.Ocular_Agent
push 0x131972f4
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d90de9
push str.Ocular_Tool
push 0x131972f4
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90df3
mov dword [0x13197708], 0x31
mov eax, dword [esp + 0x14]
push str.everything
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d90e13
mov dword [0x13197708], 0x34
lea ecx, [esp + 0x50]
mov byte [esp + 0x674], bl
call fcn.12f47220
lea ecx, [esp + 0x14]
mov byte [esp + 0x674], 0x52
call fcn.12f47220
lea ecx, [esp + 0x4c]
mov byte [esp + 0x674], 0x51
call fcn.12f47220
lea ecx, [esp + 0x10]
mov byte [esp + 0x674], 0x50
call fcn.12f41ea0
lea ecx, [esp + 0x48]
mov dword [esp + 0x674], 0x5b
call fcn.12f47220
lea ecx, [esp + 0x44]
mov byte [esp + 0x674], 0x5a
call fcn.12f47220
lea ecx, [esp + 0x40]
mov byte [esp + 0x674], 0x59
call fcn.12f47220
lea ecx, [esp + 0x3c]
mov byte [esp + 0x674], 0x58
call fcn.12f47220
lea ecx, [esp + 0x38]
mov byte [esp + 0x674], 0x57
call fcn.12f47220
lea ecx, [esp + 0x34]
mov byte [esp + 0x674], 0x56
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x674], 0x55
call fcn.12f47220
lea ecx, [esp + 0x2c]
mov dword [esp + 0x674], 0xffffffff
call fcn.12f47220
mov eax, dword [0x13197708]
cmp eax, 0x108000
je 0x12d90f61
cmp eax, 0x10d000
je 0x12d90f61
cmp eax, 0x10e000
je 0x12d90f61
cmp eax, 0x130000
je 0x12d90f61
cmp eax, 9
je 0x12d90f61
cmp eax, 0x10
je 0x12d90f61
cmp eax, 0x11
je 0x12d90f61
cmp eax, 0x12
je 0x12d90f61
cmp eax, 0x13
je 0x12d90f61
cmp eax, 0x14
je 0x12d90f61
cmp eax, 0x160000
je 0x12d90f61
cmp eax, 0x15
je 0x12d90f61
cmp eax, 0x16
je 0x12d90f61
cmp eax, 0x17
je 0x12d90f61
cmp eax, 0x18
je 0x12d90f61
cmp eax, 0x1a
je 0x12d90f61
cmp eax, 0x28
je 0x12d90f61
cmp eax, 0x1f
je 0x12d90f61
cmp eax, 0x20
je 0x12d90f61
cmp eax, 0x27
je 0x12d90f61
cmp eax, 0x29
je 0x12d90f61
cmp eax, 0x2e
jne 0x12d90f6b
mov dword [0x13197728], 1
cmp eax, 0x180000
je 0x12d90f87
cmp eax, 0x170000
je 0x12d90f87
cmp eax, 0x190000
je 0x12d90f87
cmp eax, 0x2d0000
jne 0x12d90f91
mov dword [0x13197730], 1
cmp eax, 0x100300
je 0x12d90fbe
cmp eax, 0x100500
je 0x12d90fbe
cmp eax, 0x100400
je 0x12d90fbe
mov ecx, dword [0x13196ccc]
push str.scandrive.exe
push ecx
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12d90fc8
mov dword [0x1319770c], 1
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x5d
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_dis_agentproc_hide
mov dword [esp + 0x684], ebx
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov eax, dword [esp + 0x38]
cmp eax, 0xf0000001
mov edi, eax
jne 0x12d91035
mov edx, dword [0x13196ccc]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12d91054
push edi
push esi
push str.AgentProc_Hide___d___08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], 0xffffffff
call fcn.12e9c060
xor edi, edi
cmp esi, ebp
jne 0x12d9112f
lea ecx, [esp + 0x18]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x60
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_agentproc_hide
mov dword [esp + 0x684], ebx
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov eax, dword [esp + 0x38]
cmp eax, 0xf0000001
mov esi, eax
jne 0x12d910dc
mov eax, dword [0x13196ccc]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
mov edi, eax
cmp dword [0x13198f68], ebp
je 0x12d910fa
push esi
push edi
push str.AgentProc_Hide___d___08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], 0xffffffff
call fcn.12e9c060
mov ecx, dword [0x13196ccc]
push ecx
call fcn.12f01e20
add esp, 4
test eax, eax
jne 0x12d91125
cmp edi, ebp
je 0x12d9112f
mov dword [0x1319771c], 1
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x63
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_dis_module_hide
mov dword [esp + 0x684], ebx
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov eax, dword [esp + 0x38]
cmp eax, 0xf0000001
mov edi, eax
jne 0x12d9119f
mov eax, dword [0x13196ccc]
cmp eax, ebp
je 0x12d9119f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12d911be
push edi
push esi
push str.Module_Hide___d___08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], 0xffffffff
call fcn.12e9c060
xor edi, edi
cmp esi, ebp
jne 0x12d9129d
lea ecx, [esp + 0x18]
call fcn.12e9bef0
push 1
push ebp
push ecx
mov ebx, 0x66
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_module_hide
mov dword [esp + 0x684], ebx
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov eax, dword [esp + 0x38]
cmp eax, 0xf0000001
mov esi, eax
jne 0x12d9124a
mov eax, dword [0x13196ccc]
cmp eax, ebp
je 0x12d9124a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
mov edi, eax
cmp dword [0x13198f68], ebp
je 0x12d91268
push esi
push edi
push str.Module_Hide___d___08x_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], 0xffffffff
call fcn.12e9c060
mov edx, dword [0x13196ccc]
push edx
call fcn.12f01f20
add esp, 4
test eax, eax
jne 0x12d91293
cmp edi, ebp
je 0x12d9129d
mov dword [0x13197720], 1
lea ecx, [esp + 0x18]
call fcn.12e9bef0
mov esi, 1
mov ebx, 0x69
push esi
push ebp
push ecx
mov dword [esp + 0x680], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_bitblt_disable
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
lea ecx, [esp + 0x18]
call fcn.12e9c660
cmp eax, esi
je 0x12d91357
push ebp
call fcn.12d91810
add esp, 4
test eax, eax
jne 0x12d91305
push str.hookapi_bitblt_proc
call fcn.12d916e0
add esp, 4
test eax, eax
je 0x12d9130b
mov dword [0x1319772c], esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
push ebp
push str.hookapi_bitblt_procex
call fcn.12d914a0
add esp, 0xc
test eax, eax
je 0x12d91330
mov ecx, dword [esp + 0x10]
mov dword [0x1319772c], ecx
cmp dword [0x13198f68], ebp
je 0x12d91357
mov edx, dword [0x1319772c]
or edi, 0xffffffff
push edx
push str.CAppEnvir::Init_CheckCtrlBitBlt___d_
push 0x130c56c8
push edi
call fcn.12dad750
add esp, 0x10
jmp 0x12d9135a
or edi, 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], edi
call fcn.12e9c060
lea ecx, [esp + 0x18]
call fcn.12e9bef0
push esi
push ebp
push ecx
mov ebx, 0x6b
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_disinj
mov dword [esp + 0x684], ebx
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
lea ecx, [esp + 0x18]
call fcn.12e9c660
cmp eax, esi
je 0x12d9145d
push esi
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinjcall_external_crypt
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov eax, dword [0x13196ccc]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
push 1
push ebp
push ecx
mov esi, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.hookapi_filterinjcall_external
call fcn.12f46a80
lea ecx, [esp + 0x24]
mov byte [esp + 0x680], bl
call fcn.12e9c100
mov edx, dword [0x13196ccc]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.12f46a80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x678], bl
call fcn.12e9c5e0
cmp esi, ebp
jne 0x12d91465
cmp eax, ebp
jne 0x12d91465
mov eax, dword [0x13196ccc]
push eax
call fcn.12e4cda0
add esp, 4
test eax, eax
jne 0x12d91465
jmp 0x12d9146f
mov dword [0x13197710], esi
jmp 0x12d9146f
mov dword [0x13197710], 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x674], edi
call fcn.12e9c060
mov eax, 1
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x668
ret