Function at 0x10026956
Capabilities:
Resume thread

Disassembly:
mov eax, 0x10135438
call fcn.1007db34
sub esp, 0x650
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ecx
push eax
mov dword [ebp - 0x3c], ebx
call fcn.100011ce
test eax, eax
pop ecx
je 0x10026a58
test byte [ebp - 0x3c], 1
je 0x10026a58
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, ebx
je 0x10026a08
push dword [ebp + 0x2c]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ebx
jmp 0x10026a50
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x10026a50
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10026a50
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x14]
jmp 0x100271de
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x272]
mov word [ebp - 0x274], bx
rep stosd dword es:[edi], eax
push ebx
push ebx
push ebx
push 2
push dword [ebp + 0x20]
mov dword [ebp - 0x14], ebx
stosw word es:[edi], ax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x10026b33
call fcn.100dc890
test eax, eax
je 0x10026b59
mov edi, 0x104
lea eax, [ebp - 0x274]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x101b1214]
cmp eax, ebx
je 0x10026b6d
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0x274]
lea ecx, [ebp - 0x10]
push eax
call fcn.10094520
lea eax, [ebp - 0x274]
push edi
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call fcn.10074ea7
add esp, 0xc
cmp dword [0x101b04b8], ebx
lea eax, [ebp - 0x274]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], eax
je 0x10026b25
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x10]
push 0x1e7
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__AppName__s__FmtAppName__s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10094cc0
jmp 0x10026b8e
cmp dword [0x101b04b8], ebx
je 0x10026b8e
push dword [ebp + 0x20]
push 0x1c7
push str._CSafeInject::OnNtCreateProcessEx__Line:_d_MapViewOfFile__08x__Fail___
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x14
jmp 0x10026b8e
cmp dword [0x101b04b8], ebx
je 0x10026b8e
push 0x1ce
push str._CSafeInject::OnNtCreateProcessEx__Line:_d_XPsapi::Initialize___Fail___
jmp 0x10026b7f
cmp dword [0x101b04b8], ebx
je 0x10026b8e
push 0x1d6
push str._CSafeInject::OnNtCreateProcessEx__Line:_d_GetMappedFileName_Fail___
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x10
push 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x10], ebx
call fcn.1005eb25
push dword [ebp - 0x14]
mov edi, 0x101ad1f8
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.1004dc16
test eax, eax
jne 0x10026bf6
call fcn.100511e1
test eax, eax
jne 0x10026bcc
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x10026bf6
mov ecx, edi
call fcn.1004dc65
test eax, eax
jne 0x10026bf6
cmp dword [ebp - 0x18], ebx
je 0x10026bef
lea eax, [ebp - 0x274]
mov ecx, edi
push eax
call fcn.1004f0fe
mov dword [ebp - 0x10], eax
jmp 0x10026bf6
mov dword [ebp - 0x10], 2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.1005eb48
cmp dword [ebp - 0x10], ebx
push 1
jne 0x10026cf3
lea ecx, [ebp - 0x38]
call fcn.10001261
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], ebx
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x14], ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, ebx
je 0x10026c97
push dword [ebp + 0x2c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ebx
jmp 0x10026cdf
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x10026cdf
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10026cdf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov esi, dword [esi + 0x14]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.1000127e
jmp 0x100271dc
lea ecx, [ebp - 0x40]
call fcn.10001261
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], ebx
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x24], ebx
call fcn.1005e85a
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, ebx
je 0x10026d83
push dword [ebp + 0x2c]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0x28]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0x20], eax
push dword [ebp + 0x24]
mov dword [esi + 0x24], ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xc], eax
jmp 0x10026dcb
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x10026dcb
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esi + 0xa], 0x80
mov dword [esi + 0x10], eax
je 0x10026dcb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x14]
push 4
lea ecx, [ebp - 0x54]
mov dword [ebp + 0x2c], eax
call fcn.1005eb25
xor eax, eax
lea edi, [ebp - 0x30]
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1005b974
test eax, eax
je 0x10026e23
xor eax, eax
lea edi, [ebp - 0x68]
mov dword [ebp - 0x6c], ebx
mov dword [ebp + 0x20], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x6c]
push 0x18
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax]
call dword [0x101aec64]
cmp eax, ebx
jne 0x10026e23
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
cmp dword [0x101b04b8], ebx
je 0x10026e4a
push dword [ebp - 0x2c]
push dword [ebp + 0x2c]
push 0x246
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__statusRet__08x__PID__08x_
push str.SafeInject
push 1
call fcn.1007bb15
add esp, 0x18
cmp dword [ebp + 0x2c], ebx
jne 0x100271c1
cmp dword [ebp - 0x2c], 0
je 0x100271c1
lea eax, [ebp - 0x274]
mov esi, 0x101ad1f8
push eax
mov ecx, esi
call fcn.10050190
test eax, eax
jne 0x10026ed9
mov ecx, esi
call fcn.1004ed3e
test eax, eax
jne 0x10026ea4
mov ecx, 0x101ad158
call fcn.10057be9
test eax, eax
je 0x10026ed9
lea eax, [ebp - 0x274]
push str.ReaderHostU.exe
push eax
call fcn.1007edba
pop ecx
test eax, eax
pop ecx
je 0x10026ed9
push 0
push 1
push dword [ebp - 0x2c]
call fcn.10052dd3
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.1007c2fd
lea eax, [ebp - 0x2c]
push 1
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.1007d10b
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.1007c326
push dword [ebp - 0x2c]
lea eax, [ebp - 0x274]
mov ecx, esi
push eax
call fcn.1004cf1a
test eax, eax
je 0x10026f40
lea ecx, [ebp - 0x20]
call fcn.1007c2fd
lea eax, [ebp - 0x2c]
push 1
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.1007d10b
cmp dword [0x101b04b8], 0
je 0x10026f34
push dword [ebp - 0x2c]
lea eax, [ebp - 0x274]
push eax
push 0x258
push str._CSafeInject::OnNtCreateProcessEx__Line:_d_FileDevice_Allow_it...Proc__s__PID__d_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x18
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.1007c326
lea eax, [ebp + 0x28]
and dword [ebp + 0x28], 0
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
call fcn.10027369
add esp, 0xc
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x10026f63
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x20], eax
push dword [ebp + 0x20]
mov esi, 0x101aad04
call fcn.100ab010
test eax, eax
pop ecx
je 0x10026f81
cmp dword [ebp - 0x10], 4
je 0x10026f87
and dword [ebp - 0x10], 0
jmp 0x10026f87
mov esi, dword [0x101ad644]
push esi
lea ecx, [ebp + 0xc]
call fcn.100943c0
mov eax, dword [eax]
push 0
push eax
mov byte [ebp - 4], 7
call fcn.1007344b
mov ebx, eax
pop ecx
neg ebx
pop ecx
mov byte [ebp - 4], 4
sbb bl, bl
lea ecx, [ebp + 0xc]
inc bl
call fcn.10094cc0
test bl, bl
je 0x10026fbc
and dword [ebp - 0x10], 0
xor ebx, ebx
xor edi, edi
call fcn.100bc6f0
test eax, eax
je 0x10026fd4
push str.tsysdrv.dll
call fcn.100d6050
pop ecx
mov eax, dword [ebp - 0x10]
cmp eax, 1
jne 0x10026fea
push esi
push dword [ebp - 0x30]
push dword [ebp + 0x20]
call fcn.100d7160
jmp 0x10027018
cmp eax, 2
je 0x10027005
cmp eax, 4
jne 0x10027008
push esi
push dword [ebp - 0x2c]
call fcn.10059a8e
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x1002701d
push ebx
jmp 0x1002700f
cmp eax, 3
jne 0x1002701d
push 1
push esi
push dword [ebp + 0x20]
call fcn.100d7370
add esp, 0xc
mov edi, eax
cmp dword [0x101b04b8], ebx
je 0x10027053
lea eax, [ebp - 0x274]
push eax
push edi
push dword [ebp - 0x10]
mov edi, 0x101ad158
mov ecx, edi
call fcn.100aa1c0
push eax
push str.__s___CSafeInject::OnNtCreateProcessEx___Type:_d__Inject__d____s_
push str.SafeInject
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x10027058
mov edi, 0x101ad158
mov ecx, edi
call fcn.10057df6
test eax, eax
je 0x100271a3
cmp dword [ebp - 0x14], 0
je 0x100271a3
push dword [ebp - 0x14]
call fcn.10057a13
cmp eax, 0x310
pop ecx
jne 0x100271a3
mov ecx, edi
call fcn.100aa440
push eax
lea ecx, [ebp + 0xc]
call fcn.10094520
mov eax, dword [0x101b04b8]
xor esi, esi
cmp eax, esi
mov byte [ebp - 4], 8
mov ebx, str.SafeDoc
je 0x100270c1
push dword [ebp + 0xc]
push 0x2b5
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
mov edx, dword [ebp + 0xc]
cmp dword [edx - 8], esi
je 0x10027197
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov ecx, 0xf9
stosd dword es:[edi], eax
lea edi, [ebp - 0x65a]
mov word [ebp - 0x65c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1f3
lea eax, [ebp - 0x65c]
push edx
push eax
call fcn.1007e246
lea eax, [ebp - 0x20]
push 2
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.100271ef
add esp, 0x18
cmp eax, 2
jne 0x10027179
cmp dword [0x101b04b8], esi
je 0x1002713b
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x2c7
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__Cmd1__s___Cmd2__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x18
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
call fcn.1002c5b0
mov edi, eax
push edi
push dword [ebp - 0x2c]
call fcn.1000a24d
cmp dword [0x101b04b8], esi
pop ecx
pop ecx
je 0x10027197
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push edi
push 0x2ce
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__Enable__d__PID__d__Cmd__s_
push ebx
push 4
call fcn.1007bb15
add esp, 0x1c
jmp 0x10027197
cmp dword [0x101b04b8], esi
je 0x10027197
push eax
push 0x2c2
push str._CSafeInject::OnNtCreateProcessEx__Line:_d__iCount__d_
push ebx
push 4
call fcn.1007bb15
add esp, 0x14
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.10094cc0
cmp dword [ebp + 0x28], 0
je 0x100271b2
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 0x1c], 4
jne 0x100271c1
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.1005eb48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000127e
mov esi, dword [ebp + 0x2c]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x28