Function at 0x10013140
Capabilities:
Allocate or change rwx memory
Check os version
Encode data using xor
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003dbe6
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x10049650]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x10049650]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100140f8
push 0x94
lea eax, [esp + 0xa8]
push ebx
push eax
mov dword [0x101ad0ac], esi
call fcn.10024b90
add esp, 0xc
lea ecx, [esp + 0xa4]
push ecx
mov dword [esp + 0xa8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xa8], 6
ja 0x100131ea
cmp dword [esp + 0xac], 1
ja 0x100131ea
mov byte [0x10ace698], 1
mov ecx, 0x75f76f5a
lea eax, [esp + 0x78]
call fcn.1001d000
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
sete cl
xor eax, eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
test cl, cl
je 0x1001331a
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x958d4f
call esi
lea eax, [esp + 0x10]
push eax
mov byte [0x958d4f], 0xa8
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x958d4f
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x958d50
call esi
lea eax, [esp + 0x10]
push eax
mov byte [0x958d50], 3
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x958d50
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x958d59
call esi
lea eax, [esp + 0x10]
push eax
mov byte [0x958d59], 4
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x958d59
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x4215a7
call esi
lea eax, [esp + 0x10]
push eax
mov byte [0x4215a7], 0xeb
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x4215a7
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x507aeb
call esi
lea eax, [esp + 0x10]
push eax
mov byte [0x507aeb], 0x72
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x507aeb
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 1
push 0x507afd
call esi
lea eax, [esp + 0x10]
mov byte [0x507afd], 0xeb
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 1
push 0x507afd
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 5
push 0x5bd4c0
call esi
mov eax, 0x10013040
sub eax, 0x5bd4c5
mov byte [0x5bd4c0], 0xe9
mov dword [0x5bd4c1], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
push 5
push 0x5bd4c0
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 7
push 0x5b55ea
call esi
mov eax, 0x10013100
sub eax, 0x5b55ef
mov byte [0x5b55ea], 0xe9
mov dword [0x5b55eb], eax
mov eax, 0x90909090
mov ecx, 0x5b55ef
lea edx, [esp + 0x14]
push edx
mov word [ecx], ax
mov eax, dword [esp + 0x14]
push eax
push 7
push 0x5b55ea
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5adefe
call esi
mov ecx, 0x5adefe
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 4
push 0x7257b0
call esi
lea edx, [esp + 0x10]
push edx
mov dword [0x7257b0], ebx
mov eax, dword [esp + 0x14]
push eax
push 4
push 0x7257b0
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5ae5dc
call esi
mov eax, 0x90909090
mov ecx, 0x5ae5dc
mov dword [ecx], eax
lea edx, [esp + 0x10]
mov word [ecx + 4], ax
mov eax, dword [esp + 0x10]
push edx
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5ad907
call esi
mov ecx, 0x5ad907
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5adbb0
call esi
mov ecx, 0x5adbb0
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5ae8ff
call esi
mov ecx, 0x5ae8ff
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x5aef4f
call esi
mov ecx, 0x5aef4f
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57acbf
call esi
mov eax, 0x90909090
mov ecx, 0x57acbf
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57ad03
call esi
mov ecx, 0x57ad03
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57ad47
call esi
mov ecx, 0x57ad47
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57be80
call esi
mov ecx, 0x57be80
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57bf0e
call esi
mov ecx, 0x57bf0e
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57bf78
call esi
mov ecx, 0x57bf78
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57c057
call esi
mov ecx, 0x57c057
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57c0bb
call esi
mov ecx, 0x57c0bb
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 5
push 0x57c125
call esi
mov ecx, 0x57c125
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x14]
push eax
push 5
push ecx
call esi
mov ecx, 0x75f76f5a
lea eax, [esp + 0x80]
call fcn.1001d000
push eax
call edi
test eax, eax
sete cl
xor eax, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
test cl, cl
je 0x100136fc
mov ecx, 0x1f26a98f
lea eax, [esp + 0x1c]
call fcn.1001be90
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
mov byte [esp + 0x26], al
mov ecx, 0x5cc9bff7
lea eax, [esp + 0x48]
mov dword [esp + 0x10], edi
call fcn.1001d060
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov word [esp + 0x50], cx
call eax
mov ebx, 0xff
push ebx
lea ecx, [esp + 0x154]
push 0x1b
push ecx
mov eax, 0x400000
mov dword [esp + 0x15c], 0xffffffa1
mov dword [esp + 0x160], 0xffffffff
mov dword [esp + 0x164], 0xffff8b32
mov dword [esp + 0x168], 0xffffffff
mov dword [esp + 0x16c], 0x78ffffff
mov dword [esp + 0x170], 0x8bffff89
mov word [esp + 0x174], 0x8ff
mov byte [esp + 0x176], 0x51
call fcn.100041b0
add esp, 0xc
test eax, eax
je 0x10013ef5
mov edx, dword [eax + 1]
push ebx
lea eax, [esp + 0x154]
push 0x21
push eax
mov eax, 0x400000
mov dword [0x10ace958], edx
mov dword [esp + 0x15c], 0xffffffa1
mov dword [esp + 0x160], 0xffff89ff
mov dword [esp + 0x164], 0x83ffffff
mov dword [esp + 0x168], 0xffffffff
mov dword [esp + 0x16c], 0xffff02ff
mov dword [esp + 0x170], 0xffffff83
mov dword [esp + 0x174], 0x7404ffff
mov dword [esp + 0x178], 0x6affebff
mov byte [esp + 0x17c], 0
call fcn.100041b0
add esp, 0xc
mov dword [0x10ace95c], eax
test eax, eax
je 0x1001380a
mov ecx, dword [eax + 1]
mov dword [0x10ace95c], ecx
jmp 0x10013856
mov eax, 0xba
xor edi, edi
mov dl, byte [edi + 0x10043b34]
xor dl, al
inc eax
mov byte [esp + edi + 0x38], dl
inc edi
and eax, ebx
cmp edi, 0xf
jb 0x10013811
lea eax, [esp + 0x38]
push eax
push 0
mov ecx, 0x100aab80
mov byte [esp + 0x4f], 0
call fcn.10004f40
xor eax, eax
add esp, 8
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.10004450
push ebx
lea ecx, [esp + 0x140]
push 0x11
push ecx
mov eax, 0x400000
mov dword [esp + 0x148], 0xffffff66
mov dword [esp + 0x14c], 0xff66ffff
mov dword [esp + 0x150], 0xff8b24ff
mov dword [esp + 0x154], 0xffffffff
mov byte [esp + 0x158], 0x51
call fcn.100041b0
add esp, 0xc
mov dword [0x10ace97c], eax
test eax, eax
je 0x100138b6
mov edx, dword [eax + 2]
mov dword [0x10ace97c], edx
jmp 0x100138e9
mov ecx, 0x10043b44
sub ecx, 0x575d72e6
lea eax, [esp + 0x70]
call fcn.1001d0e0
push eax
push 0
mov ecx, 0x100aab80
call fcn.10004f40
xor eax, eax
add esp, 8
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
call fcn.10004450
mov eax, 0xfe
push eax
lea eax, [esp + 0x140]
push 0xb
push eax
mov eax, 0x400000
mov dword [esp + 0x148], 0xfefefe83
mov dword [esp + 0x14c], 0x74fffefe
mov word [esp + 0x150], 0x6afe
mov byte [esp + 0x152], 0x1a
call fcn.100041b0
add esp, 0xc
mov dword [0x10ace960], eax
test eax, eax
je 0x10013942
mov ecx, dword [eax + 2]
mov dword [0x10ace960], ecx
jmp 0x100139a7
mov eax, 0xde
xor edi, edi
lea esp, [esp]
mov dl, byte [edi + 0x10043b4c]
xor dl, al
inc eax
mov byte [esp + edi + 0x54], dl
inc edi
and eax, ebx
cmp edi, 0x18
jb 0x10013950
mov byte [esp + 0x6c], 0
lea ecx, [esp + 0x54]
mov dword [esp + 0x1a8], 0
call fcn.10004500
xor eax, eax
mov dword [esp + 0x1a8], 0xffffffff
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov byte [esp + 0x6c], al
push ebx
lea eax, [esp + 0x184]
push 0x17
push eax
mov eax, 0x400000
mov dword [esp + 0x18c], 0x8e68
mov dword [esp + 0x190], 0xc16800
mov dword [esp + 0x194], 0xff8d0000
mov dword [esp + 0x198], 0xffffffff
mov dword [esp + 0x19c], 0xffffffe8
mov word [esp + 0x1a0], 0x6aff
mov byte [esp + 0x1a2], 2
call fcn.100041b0
add esp, 0xc
test eax, eax
je 0x10013ee9
mov ecx, dword [eax + 0x48]
mov edx, dword [eax + ecx + 0x57]
lea eax, [eax + ecx + 0x4c]
lea ecx, [eax + edx + 0xf]
mov dword [0x10ace984], ecx
add ecx, 0x2d
mov dword [0x101ad0b0], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x101ad0b0], ecx
mov edx, dword [eax + 0x26]
lea ecx, [eax + edx + 0x2a]
mov dword [0x10ace68c], 0x1000dbf0
cmp byte [eax], 0x55
mov dword [0x101accf0], eax
mov dword [0x101acd18], ecx
je 0x10013a61
call fcn.10004450
mov edx, dword [0x10ace984]
cmp byte [edx], 0x55
je 0x10013a71
call fcn.10004450
mov eax, dword [0x101acd18]
cmp byte [eax], 0x55
je 0x10013a80
call fcn.10004450
mov edi, dword [0x10ace984]
push 0xc3
mov esi, 0x76
call fcn.10004170
mov edi, dword [0x101acd18]
add esp, 4
push 0xc3
mov esi, 0x1e0
call fcn.10004170
mov edi, dword [0x101accf0]
add esp, 4
push 0xc3
mov esi, 0x33
call fcn.10004170
lea ebx, [esi - 0x2e]
mov esi, dword [0x101accf0]
add esp, 4
mov eax, 0x1000db40
call fcn.10004110
push 0xa0
push 0
push 0x101ad0b8
call fcn.10024b90
add esp, 0xc
push 0
push 0xa0
push 0x101ad0b8
push 0x1000db40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call esi
xor eax, eax
mov cl, byte [eax + 0x101ad0b8]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x101ad0b8], cl
inc eax
cmp eax, 0xa0
jb 0x10013b11
push 0x7c
push 0
push 0x101acd28
call fcn.10024b90
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0xc
push 0
push 0x7c
push 0x101acd28
push fcn.1000d770
call edi
push eax
call esi
xor eax, eax
jmp 0x10013b60
mov dl, byte [eax + 0x101acd28]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x101acd28], dl
inc eax
cmp eax, 0x7c
jb 0x10013b60
push 0x1f9
push 0
push 0x101aceb0
call fcn.10024b90
add esp, 0xc
push 0
push 0x1f9
push 0x101aceb0
push fcn.1000d7f0
call edi
push eax
call esi
xor eax, eax
mov cl, byte [eax + 0x101aceb0]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x101aceb0], cl
inc eax
cmp eax, 0x1f9
jb 0x10013ba4
push 0xfb
push 0
push 0x101ad2a8
call fcn.10024b90
add esp, 0xc
push 0
push 0xfb
push 0x101ad2a8
push fcn.1000d9f0
call edi
push eax
call esi
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x101ad2a8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x101ad2a8], dl
inc eax
cmp eax, 0xfb
jb 0x10013bf0
mov esi, dword [esp + 0x10]
mov ebx, 0xff
push ebx
lea eax, [esp + 0x154]
push 0x18
push eax
mov eax, esi
mov dword [esp + 0x15c], 0x8bcccccc
mov dword [esp + 0x160], 0xff8904ff
mov dword [esp + 0x164], 0xffffffff
mov dword [esp + 0x168], 0x8908ff8b
mov dword [esp + 0x16c], 0xffffffff
mov dword [esp + 0x170], 0xcff8bff
mov dword [esp + 0x18c], 0x8bcccccc
mov dword [esp + 0x190], 0xffa304ff
mov dword [esp + 0x194], 0x8bffffff
mov dword [esp + 0x198], 0xffa308ff
mov dword [esp + 0x19c], 0x8bffffff
mov word [esp + 0x1a0], 0xcff
mov dword [esp + 0x148], 0xffcccccc
mov dword [esp + 0x14c], 0x8b0448ff
mov dword [esp + 0x150], 0xffffffff
mov dword [esp + 0x154], 0xffff66ff
mov byte [esp + 0x158], 0x18
call fcn.100041b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10013d52
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor esi, esi
push esi
push 1
push 0x10acea3c
mov dword [0x10ace954], 0x70
call ebx
test eax, eax
je 0x10013d26
cmp esi, 0x20
jae 0x10013d0e
push 0
jmp 0x10013d10
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 1
push 0x10acea3c
inc esi
call ebx
test eax, eax
jne 0x10013d05
cmp dword [0x10aceb40], 0
jne 0x10013d40
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10aceb40], eax
push 0
push 0x10acea3c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x10013e4e
push ebx
lea ecx, [esp + 0x184]
push 0x16
push ecx
mov eax, esi
call fcn.100041b0
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
je 0x10013dbf
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor esi, esi
push esi
push 1
push 0x10acea3c
mov dword [0x10ace954], 0x70
call ebx
test eax, eax
je 0x10013e23
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp esi, 0x20
jae 0x10013da9
push 0
jmp 0x10013dab
push 1
call edi
push 0
push 1
push 0x10acea3c
inc esi
call ebx
test eax, eax
jne 0x10013da0
jmp 0x10013e23
push ebx
lea edx, [esp + 0x140]
push 0x11
push edx
mov eax, esi
call fcn.100041b0
add esp, 0xc
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10013e6d
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
push 1
push 0x10acea3c
mov dword [0x10ace954], 0x4e
call ebx
test eax, eax
je 0x10013e23
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x10013e0f
push 0
jmp 0x10013e11
push 1
call edi
push 0
push 1
push 0x10acea3c
inc esi
call ebx
test eax, eax
jne 0x10013e06
cmp dword [0x10aceb40], 0
jne 0x10013e3d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10aceb40], eax
push 0
push 0x10acea3c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edi, dword [esp + 0x10]
add edi, 3
mov ecx, edi
call fcn.1001fb30
call fcn.1001fcd0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, 0xff
jmp 0x10013f45
mov eax, 3
mov cl, byte [esi + str.eqkeXOJDnNfnbpqgqgUvtzH]
xor cl, al
inc eax
mov byte [esp + esi + 0x88], cl
inc esi
and eax, ebx
cmp esi, 0x1b
jb 0x10013e72
mov byte [esp + 0xa3], 0
lea ecx, [esp + 0x88]
mov dword [esp + 0x1a8], 1
call fcn.10004500
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov ebx, 0xff
jmp 0x10013f45
mov ecx, str.Unkw_FindStruct_Data_Packet
call fcn.10004500
jmp 0x10013f45
mov eax, 0x82
xor edi, edi
lea esp, [esp]
mov dl, byte [edi + 0x10043ba0]
xor dl, al
inc eax
mov byte [esp + edi + 0x28], dl
inc edi
and eax, ebx
cmp edi, 0xf
jb 0x10013f00
lea eax, [esp + 0x28]
push eax
push 0
mov ecx, 0x100aab80
mov byte [esp + 0x3f], 0
call fcn.10004f40
xor eax, eax
add esp, 8
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call fcn.10004450
push 0xc
lea ecx, [esp + 0x140]
xor eax, eax
push ecx
push 0x400000
mov dword [esp + 0x15c], 0xffe8c88b
mov dword [esp + 0x160], 0xe8ffffff
mov dword [esp + 0x164], 0xffffffff
mov dword [esp + 0x168], 0xffffffe8
mov dword [esp + 0x16c], 0xffffe8ff
mov dword [esp + 0x170], 0xffe8ffff
mov dword [esp + 0x174], 0xe8ffffff
mov dword [esp + 0x178], 0xffffffff
mov dword [esp + 0x17c], 0xffffffe8
mov dword [esp + 0x180], 0xffffe8ff
mov dword [esp + 0x184], 0x1b0ffff
mov dword [esp + 0x188], 0xc35de58b
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov edi, dword [esp + 0x140]
xor edx, edx
test edi, edi
je 0x10014040
lea esp, [esp]
xor eax, eax
mov cl, byte [esp + eax + 0x150]
cmp cl, bl
je 0x10014026
cmp byte [eax + edx + 0x400000], cl
jne 0x10014034
inc eax
cmp eax, 0x30
jl 0x10014012
lea eax, [edx + 0x400000]
jmp 0x1001406f
inc edx
cmp edx, edi
jb 0x10014010
jmp 0x1001406d
xor eax, eax
mov cl, byte [esp + eax + 0x150]
cmp cl, bl
je 0x10014056
cmp byte [eax + edx + 0x400000], cl
jne 0x10014064
inc eax
cmp eax, 0x30
jl 0x10014042
lea eax, [edx + 0x400000]
jmp 0x1001406f
inc edx
cmp edx, 0x2000000
jb 0x10014040
xor eax, eax
mov dword [0x101ad0b4], eax
test eax, eax
je 0x100140c5
lea edx, [eax + 0x20]
lea edi, [eax + 0x1b]
mov eax, edi
mov dword [0x101acd24], eax
mov dword [0x101ad2a0], edx
mov ecx, dword [eax + 1]
lea edx, [eax + ecx + 5]
lea eax, [esp + 0x14]
push eax
push 0x40
push 5
push edi
mov dword [0x101acd24], edx
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, 0x1000d640
sub ecx, edi
push 5
sub ecx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], ecx
call esi
jmp 0x100140ca
call fcn.10004450
xor ecx, ecx
mov edi, 0x1000ed60
mov dword [0x101ad0b4], 0
call fcn.100042b0
xor ecx, ecx
mov edi, 0x1000f540
call fcn.100042b0
xor ecx, ecx
mov edi, 0x10012750
call fcn.100042b0
mov eax, 1
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.1002121a
mov esp, ebp
pop ebp
ret 0xc