Code:
10001FA8 68 007B2E10 PUSH CShell.102E7B00 ; ASCII "AntiMemHackThread"
10001FAD 57 PUSH EDI
10001FAE FFD2 CALL EDX
10001FB0 68 C8000000 PUSH 0C8
10001FB5 899F 9C000000 MOV DWORD PTR DS:[EDI+9C],EBX
10001FBB 899F A0000000 MOV DWORD PTR DS:[EDI+A0],EBX
10001FC1 899F A4000000 MOV DWORD PTR DS:[EDI+A4],EBX
10001FC7 899F A8000000 MOV DWORD PTR DS:[EDI+A8],EBX
10001FCD 90 NOP
10001FCE E8 2CF11C65 CALL kernel32.Sleep
10001FD3 5E POP ESI
10001FD4 5B POP EBX
10001FD5 C3 RETN
10001FD6 CC INT3
10001FD7 CC INT3
10001FD8 CC INT3
10001FD9 CC INT3
10001FDA CC INT3
10001FDB CC INT3
10001FDC CC INT3
10001FDD CC INT3
10001FDE CC INT3
10001FDF CC INT3
10001FE0 55 PUSH EBP
10001FE1 8BEC MOV EBP,ESP
10001FE3 83E4 F8 AND ESP,FFFFFFF8
10001FE6 83EC 14 SUB ESP,14
10001FE9 53 PUSH EBX
10001FEA 8BD8 MOV EBX,EAX
10001FEC 8B8B B8000000 MOV ECX,DWORD PTR DS:[EBX+B8]
10001FF2 8B01 MOV EAX,DWORD PTR DS:[ECX]
10001FF4 8B50 0C MOV EDX,DWORD PTR DS:[EAX+C]
10001FF7 56 PUSH ESI
10001FF8 57 PUSH EDI
10001FF9 FFD2 CALL EDX
10001FFB 8B8B B8000000 MOV ECX,DWORD PTR DS:[EBX+B8]
10002001 85C9 TEST ECX,ECX
10002003 74 08 JE SHORT CShell.1000200D
10002005 8B01 MOV EAX,DWORD PTR DS:[ECX]
10002007 8B10 MOV EDX,DWORD PTR DS:[EAX]
10002009 6A 01 PUSH 1
1000200B FFD2 CALL EDX
1000200D 8B35 4CF12910 MOV ESI,DWORD PTR DS:[1029F14C] ; ntdll.RtlEnterCriticalSection
10002013 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
10002016 50 PUSH EAX
10002017 FFD6 CALL ESI
10002019 8D7B 08 LEA EDI,DWORD PTR DS:[EBX+8]
1000201C 57 PUSH EDI
1000201D FFD6 CALL ESI
1000201F 8B43 24 MOV EAX,DWORD PTR DS:[EBX+24]
10002022 8B08 MOV ECX,DWORD PTR DS:[EAX]
10002024 8D73 20 LEA ESI,DWORD PTR DS:[EBX+20]
10002027 57 PUSH EDI
10002028 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX
1000202C 90 NOP
1000202D E8 3E029367 CALL ntdll.RtlLeaveCriticalSection
10002032 8BFE MOV EDI,ESI
10002034 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14]
10002038 897C24 18 MOV DWORD PTR SS:[ESP+18],EDI
1000203C 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
10002040 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
10002043 50 PUSH EAX
10002044 90 NOP
10002045 E8 66029367 CALL ntdll.RtlEnterCriticalSection
1000204A 85FF TEST EDI,EDI
1000204C 8B53 24 MOV EDX,DWORD PTR DS:[EBX+24]
1000204F 8D43 20 LEA EAX,DWORD PTR DS:[EBX+20]
10002052 895424 14 MOV DWORD PTR SS:[ESP+14],EDX
10002056 74 04 JE SHORT CShell.1000205C
10002058 3BF8 CMP EDI,EAX
1000205A 74 06 JE SHORT CShell.10002062
1000205C 90 NOP
1000205D E8 326ADC5F CALL MSVCR80._invalid_parameter_noinfo
10002062 3B7424 14 CMP ESI,DWORD PTR SS:[ESP+14]
10002066 0F84 D8000000 JE CShell.10002144
1000206C 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
1000206F 50 PUSH EAX
10002070 90 NOP
10002071 E8 FA019367 CALL ntdll.RtlLeaveCriticalSection
10002076 85FF TEST EDI,EDI
10002078 75 06 JNZ SHORT CShell.10002080
1000207A 90 NOP
1000207B E8 146ADC5F CALL MSVCR80._invalid_parameter_noinfo
10002080 3B77 04 CMP ESI,DWORD PTR DS:[EDI+4]
10002083 75 06 JNZ SHORT CShell.1000208B
10002085 90 NOP
10002086 E8 096ADC5F CALL MSVCR80._invalid_parameter_noinfo
1000208B 837E 08 00 CMP DWORD PTR DS:[ESI+8],0
1000208F 0F84 9D000000 JE CShell.10002132
10002095 3B77 04 CMP ESI,DWORD PTR DS:[EDI+4]
10002098 75 06 JNZ SHORT CShell.100020A0
1000209A 90 NOP
1000209B E8 F469DC5F CALL MSVCR80._invalid_parameter_noinfo
100020A0 8B7E 08 MOV EDI,DWORD PTR DS:[ESI+8]
100020A3 85FF TEST EDI,EDI
100020A5 74 1E JE SHORT CShell.100020C5
100020A7 8B47 08 MOV EAX,DWORD PTR DS:[EDI+8]
100020AA 85C0 TEST EAX,EAX
100020AC 74 0E JE SHORT CShell.100020BC
100020AE 50 PUSH EAX
100020AF 90 NOP
100020B0 E8 B1BE3365 CALL ADVAPI32.CryptDestroyHash
100020B5 C747 08 00000000 MOV DWORD PTR DS:[EDI+8],0
100020BC 57 PUSH EDI
100020BD E8 528E2800 CALL CShell.1028AF14
100020C2 83C4 04 ADD ESP,4
100020C5 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18]
100020C9 3B70 04 CMP ESI,DWORD PTR DS:[EAX+4]
100020CC 8BFE MOV EDI,ESI
100020CE 75 06 JNZ SHORT CShell.100020D6
100020D0 90 NOP
100020D1 E8 BE69DC5F CALL MSVCR80._invalid_parameter_noinfo
100020D6 8B36 MOV ESI,DWORD PTR DS:[ESI]
100020D8 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
100020DB 50 PUSH EAX
100020DC 90 NOP
100020DD E8 CE019367 CALL ntdll.RtlEnterCriticalSection
100020E2 837C24 18 00 CMP DWORD PTR SS:[ESP+18],0
100020E7 75 06 JNZ SHORT CShell.100020EF
100020E9 90 NOP
100020EA E8 A569DC5F CALL MSVCR80._invalid_parameter_noinfo
100020EF 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18]
100020F3 3B78 04 CMP EDI,DWORD PTR DS:[EAX+4]
100020F6 75 06 JNZ SHORT CShell.100020FE
100020F8 90 NOP
100020F9 E8 9669DC5F CALL MSVCR80._invalid_parameter_noinfo
100020FE 3B7B 24 CMP EDI,DWORD PTR DS:[EBX+24]
10002101 74 1C JE SHORT CShell.1000211F
10002103 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4]
10002106 8B17 MOV EDX,DWORD PTR DS:[EDI]
10002108 8911 MOV DWORD PTR DS:[ECX],EDX
1000210A 8B07 MOV EAX,DWORD PTR DS:[EDI]
1000210C 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4]
1000210F 57 PUSH EDI
10002110 8948 04 MOV DWORD PTR DS:[EAX+4],ECX
10002113 E8 FC8D2800 CALL CShell.1028AF14
10002118 83C4 04 ADD ESP,4
1000211B 8343 28 FF ADD DWORD PTR DS:[EBX+28],-1
1000211F 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
10002122 50 PUSH EAX
10002123 90 NOP
10002124 E8 47019367 CALL ntdll.RtlLeaveCriticalSection
10002129 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18]
1000212D ^E9 0EFFFFFF JMP CShell.10002040
10002132 3B77 04 CMP ESI,DWORD PTR DS:[EDI+4]
10002135 75 06 JNZ SHORT CShell.1000213D
10002137 90 NOP
10002138 E8 5769DC5F CALL MSVCR80._invalid_parameter_noinfo
1000213D 8B36 MOV ESI,DWORD PTR DS:[ESI]
1000213F ^E9 FCFEFFFF JMP CShell.10002040
10002144 8B35 50F12910 MOV ESI,DWORD PTR DS:[1029F150] ; ntdll.RtlLeaveCriticalSection
1000214A 8D53 08 LEA EDX,DWORD PTR DS:[EBX+8]
1000214D 52 PUSH EDX
1000214E FFD6 CALL ESI
10002150 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8]
10002153 50 PUSH EAX
10002154 FFD6 CALL ESI
10002156 8D73 34 LEA ESI,DWORD PTR DS:[EBX+34]
10002159 C74424 10 040000>MOV DWORD PTR SS:[ESP+10],4
10002161 8B06 MOV EAX,DWORD PTR DS:[ESI]
10002163 3946 FC CMP DWORD PTR DS:[ESI-4],EAX
10002166 894424 0C MOV DWORD PTR SS:[ESP+C],EAX
1000216A 76 06 JBE SHORT CShell.10002172
1000216C 90 NOP
1000216D E8 2269DC5F CALL MSVCR80._invalid_parameter_noinfo
10002172 8B7E FC MOV EDI,DWORD PTR DS:[ESI-4]
10002175 3B3E CMP EDI,DWORD PTR DS:[ESI]
10002177 76 06 JBE SHORT CShell.1000217F
10002179 90 NOP
1000217A E8 1569DC5F CALL MSVCR80._invalid_parameter_noinfo
1000217F 8D46 F8 LEA EAX,DWORD PTR DS:[ESI-8]
10002182 85C0 TEST EAX,EAX
10002184 75 06 JNZ SHORT CShell.1000218C
10002186 90 NOP
10002187 E8 0869DC5F CALL MSVCR80._invalid_parameter_noinfo
1000218C 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
10002190 3BF9 CMP EDI,ECX
10002192 74 30 JE SHORT CShell.100021C4
10002194 8B06 MOV EAX,DWORD PTR DS:[ESI]
10002196 2BC1 SUB EAX,ECX
10002198 C1F8 02 SAR EAX,2
1000219B 85C0 TEST EAX,EAX
1000219D 8D0C85 00000000 LEA ECX,DWORD PTR DS:[EAX*4]
100021A4 8D1439 LEA EDX,DWORD PTR DS:[ECX+EDI]
100021A7 895424 18 MOV DWORD PTR SS:[ESP+18],EDX
100021AB 7E 11 JLE SHORT CShell.100021BE
100021AD 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C]
100021B1 51 PUSH ECX
100021B2 50 PUSH EAX
100021B3 51 PUSH ECX
100021B4 57 PUSH EDI
100021B5 90 NOP
100021B6 E8 EDE2E05F CALL MSVCR80.memmove_s
100021BB 83C4 10 ADD ESP,10
100021BE 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18]
100021C2 890E MOV DWORD PTR DS:[ESI],ECX
100021C4 83C6 1C ADD ESI,1C
100021C7 836C24 10 01 SUB DWORD PTR SS:[ESP+10],1
100021CC ^75 93 JNZ SHORT CShell.10002161
100021CE 81C3 9C000000 ADD EBX,9C
100021D4 BF 04000000 MOV EDI,4
100021D9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
100021E0 8B33 MOV ESI,DWORD PTR DS:[EBX]
100021E2 85F6 TEST ESI,ESI
100021E4 74 24 JE SHORT CShell.1000220A
100021E6 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8]
100021E9 85C0 TEST EAX,EAX
100021EB 74 0E JE SHORT CShell.100021FB
100021ED 50 PUSH EAX
100021EE 90 NOP
100021EF E8 72BD3365 CALL ADVAPI32.CryptDestroyHash
100021F4 C746 08 00000000 MOV DWORD PTR DS:[ESI+8],0
100021FB 56 PUSH ESI
100021FC E8 138D2800 CALL CShell.1028AF14
10002201 83C4 04 ADD ESP,4
10002204 C703 00000000 MOV DWORD PTR DS:[EBX],0
1000220A 83C3 04 ADD EBX,4
1000220D 83EF 01 SUB EDI,1
10002210 ^75 CE JNZ SHORT CShell.100021E0
10002212 5F POP EDI
10002213 5E POP ESI
10002214 5B POP EBX
10002215 8BE5 MOV ESP,EBP
10002217 5D POP EBP
10002218 C3 RETN
10002219 CC INT3
1000221A CC INT3
1000221B CC INT3
1000221C CC INT3
1000221D CC INT3
1000221E CC INT3
1000221F CC INT3
10002220 55 PUSH EBP
10002221 8BEC MOV EBP,ESP
10002223 83E4 F8 AND ESP,FFFFFFF8
10002226 6A FF PUSH -1
10002228 68 10C62910 PUSH CShell.1029C610
1000222D 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
10002233 50 PUSH EAX
10002234 83EC 6C SUB ESP,6C
10002237 53 PUSH EBX
10002238 56 PUSH ESI
10002239 A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
1000223E 33C4 XOR EAX,ESP
10002240 50 PUSH EAX
10002241 8D4424 78 LEA EAX,DWORD PTR SS:[ESP+78]
10002245 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
1000224B 8B87 B8000000 MOV EAX,DWORD PTR DS:[EDI+B8]
10002251 8B80 14010000 MOV EAX,DWORD PTR DS:[EAX+114]
10002257 50 PUSH EAX
10002258 90 NOP
10002259 E8 67F41C65 CALL kernel32.SetEvent
1000225E 33DB XOR EBX,EBX
10002260 53 PUSH EBX
10002261 53 PUSH EBX
10002262 53 PUSH EBX
10002263 53 PUSH EBX
10002264 90 NOP
10002265 E8 22101D65 CALL kernel32.CreateEventA
1000226A 8B8F B8000000 MOV ECX,DWORD PTR DS:[EDI+B8]
10002270 8B35 38F12910 MOV ESI,DWORD PTR DS:[1029F138] ; kernel32.WaitForMultipleObjects
10002276 8987 BC000000 MOV DWORD PTR DS:[EDI+BC],EAX
1000227C 8B91 10010000 MOV EDX,DWORD PTR DS:[ECX+110]
10002282 895424 1C MOV DWORD PTR SS:[ESP+1C],EDX
10002286 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1000228A 895C24 14 MOV DWORD PTR SS:[ESP+14],EBX
1000228E 895C24 18 MOV DWORD PTR SS:[ESP+18],EBX
10002292 C74424 10 010000>MOV DWORD PTR SS:[ESP+10],1
1000229A 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
100022A0 6A FF PUSH -1
100022A2 53 PUSH EBX
100022A3 8D4424 24 LEA EAX,DWORD PTR SS:[ESP+24]
100022A7 50 PUSH EAX
100022A8 6A 02 PUSH 2
100022AA FFD6 CALL ESI
100022AC 2BC3 SUB EAX,EBX
100022AE 0F84 F2010000 JE CShell.100024A6
100022B4 83E8 01 SUB EAX,1
100022B7 ^75 E7 JNZ SHORT CShell.100022A0
100022B9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
100022C0 8B8F B4000000 MOV ECX,DWORD PTR DS:[EDI+B4]
100022C6 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C]
100022CA 51 PUSH ECX
100022CB 52 PUSH EDX
100022CC 90 NOP
100022CD E8 64EE1C65 CALL kernel32.WaitForSingleObject
100022D2 85C0 TEST EAX,EAX
100022D4 0F84 CC010000 JE CShell.100024A6
100022DA 837C24 10 00 CMP DWORD PTR SS:[ESP+10],0
100022DF 74 31 JE SHORT CShell.10002312
100022E1 8D77 08 LEA ESI,DWORD PTR DS:[EDI+8]
100022E4 56 PUSH ESI
100022E5 90 NOP
100022E6 E8 C5FF9267 CALL ntdll.RtlEnterCriticalSection
100022EB 8B47 24 MOV EAX,DWORD PTR DS:[EDI+24]
100022EE 8B00 MOV EAX,DWORD PTR DS:[EAX]
100022F0 8D5F 20 LEA EBX,DWORD PTR DS:[EDI+20]
100022F3 56 PUSH ESI
100022F4 894424 2C MOV DWORD PTR SS:[ESP+2C],EAX
100022F8 90 NOP
100022F9 E8 72FF9267 CALL ntdll.RtlLeaveCriticalSection
100022FE 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28]
10002302 895C24 14 MOV DWORD PTR SS:[ESP+14],EBX
10002306 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX
1000230A C74424 10 000000>MOV DWORD PTR SS:[ESP+10],0
10002312 83BF AC000000 00 CMP DWORD PTR DS:[EDI+AC],0
10002319 C787 B0000000 00>MOV DWORD PTR DS:[EDI+B0],0
10002323 ^76 9B JBE SHORT CShell.100022C0
10002325 8B1D 4CF12910 MOV EBX,DWORD PTR DS:[1029F14C] ; ntdll.RtlEnterCriticalSection
1000232B 8D77 08 LEA ESI,DWORD PTR DS:[EDI+8]
1000232E 56 PUSH ESI
1000232F FFD3 CALL EBX
10002331 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
10002335 85C9 TEST ECX,ECX
10002337 8B57 24 MOV EDX,DWORD PTR DS:[EDI+24]
1000233A 8D47 20 LEA EAX,DWORD PTR DS:[EDI+20]
1000233D 895424 30 MOV DWORD PTR SS:[ESP+30],EDX
10002341 74 04 JE SHORT CShell.10002347
10002343 3BC8 CMP ECX,EAX
10002345 74 06 JE SHORT CShell.1000234D
10002347 90 NOP
10002348 E8 4767DC5F CALL MSVCR80._invalid_parameter_noinfo
1000234D 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30]
10002351 394424 18 CMP DWORD PTR SS:[ESP+18],EAX
10002355 56 PUSH ESI
10002356 75 30 JNZ SHORT CShell.10002388
10002358 90 NOP
10002359 E8 12FF9267 CALL ntdll.RtlLeaveCriticalSection
1000235E 8D77 08 LEA ESI,DWORD PTR DS:[EDI+8]
10002361 56 PUSH ESI
10002362 FFD3 CALL EBX
10002364 8B4F 24 MOV ECX,DWORD PTR DS:[EDI+24]
10002367 8B11 MOV EDX,DWORD PTR DS:[ECX]
10002369 8D5F 20 LEA EBX,DWORD PTR DS:[EDI+20]
1000236C 56 PUSH ESI
1000236D 895424 3C MOV DWORD PTR SS:[ESP+3C],EDX
10002371 90 NOP
10002372 E8 F9FE9267 CALL ntdll.RtlLeaveCriticalSection
10002377 8B4424 38 MOV EAX,DWORD PTR SS:[ESP+38]
1000237B 895C24 14 MOV DWORD PTR SS:[ESP+14],EBX
1000237F 894424 18 MOV DWORD PTR SS:[ESP+18],EAX
10002383 E9 FD000000 JMP CShell.10002485
10002388 90 NOP
10002389 E8 E2FE9267 CALL ntdll.RtlLeaveCriticalSection
1000238E 8B5C24 14 MOV EBX,DWORD PTR SS:[ESP+14]
10002392 85DB TEST EBX,EBX
10002394 75 06 JNZ SHORT CShell.1000239C
10002396 90 NOP
10002397 E8 F866DC5F CALL MSVCR80._invalid_parameter_noinfo
1000239C 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18]
100023A0 3B73 04 CMP ESI,DWORD PTR DS:[EBX+4]
100023A3 75 06 JNZ SHORT CShell.100023AB
100023A5 90 NOP
100023A6 E8 E966DC5F CALL MSVCR80._invalid_parameter_noinfo
100023AB 8B5E 08 MOV EBX,DWORD PTR DS:[ESI+8]
100023AE 8D7424 58 LEA ESI,DWORD PTR SS:[ESP+58]
100023B2 8BCB MOV ECX,EBX
100023B4 E8 B7050000 CALL CShell.10002970
100023B9 8BF0 MOV ESI,EAX
100023BB 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C]
100023BF 8BC3 MOV EAX,EBX
100023C1 C78424 80000000 >MOV DWORD PTR SS:[ESP+80],0
100023CC E8 2F050000 CALL CShell.10002900
100023D1 8BC8 MOV ECX,EAX
100023D3 C68424 80000000 >MOV BYTE PTR SS:[ESP+80],1
100023DB 837E 18 10 CMP DWORD PTR DS:[ESI+18],10
100023DF 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14]
100023E2 72 05 JB SHORT CShell.100023E9
100023E4 8B76 04 MOV ESI,DWORD PTR DS:[ESI+4]
100023E7 EB 03 JMP SHORT CShell.100023EC
100023E9 83C6 04 ADD ESI,4
100023EC 50 PUSH EAX
100023ED 8B41 14 MOV EAX,DWORD PTR DS:[ECX+14]
100023F0 8BD6 MOV EDX,ESI
100023F2 E8 89030000 CALL CShell.10002780
100023F7 85C0 TEST EAX,EAX
100023F9 BE 10000000 MOV ESI,10
100023FE 0F944424 0F SETE BYTE PTR SS:[ESP+F]
10002403 397424 54 CMP DWORD PTR SS:[ESP+54],ESI
10002407 72 0D JB SHORT CShell.10002416
10002409 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40]
1000240D 51 PUSH ECX
1000240E E8 018B2800 CALL CShell.1028AF14
10002413 83C4 04 ADD ESP,4
10002416 C78424 80000000 >MOV DWORD PTR SS:[ESP+80],-1
10002421 397424 70 CMP DWORD PTR SS:[ESP+70],ESI
10002425 C74424 54 0F0000>MOV DWORD PTR SS:[ESP+54],0F
1000242D C74424 50 000000>MOV DWORD PTR SS:[ESP+50],0
10002435 C64424 40 00 MOV BYTE PTR SS:[ESP+40],0
1000243A 72 0D JB SHORT CShell.10002449
1000243C 8B5424 5C MOV EDX,DWORD PTR SS:[ESP+5C]
10002440 52 PUSH EDX
10002441 E8 CE8A2800 CALL CShell.1028AF14
10002446 83C4 04 ADD ESP,4
10002449 807C24 0F 00 CMP BYTE PTR SS:[ESP+F],0
1000244E C74424 70 0F0000>MOV DWORD PTR SS:[ESP+70],0F
10002456 C74424 6C 000000>MOV DWORD PTR SS:[ESP+6C],0
1000245E C64424 5C 00 MOV BYTE PTR SS:[ESP+5C],0
10002463 74 37 JE SHORT CShell.1000249C
10002465 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18]
10002469 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
1000246D 8387 B0000000 01 ADD DWORD PTR DS:[EDI+B0],1
10002474 3B70 04 CMP ESI,DWORD PTR DS:[EAX+4]
10002477 75 06 JNZ SHORT CShell.1000247F
10002479 90 NOP
1000247A E8 1566DC5F CALL MSVCR80._invalid_parameter_noinfo
1000247F 8B0E MOV ECX,DWORD PTR DS:[ESI]
10002481 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX
10002485 8B97 B0000000 MOV EDX,DWORD PTR DS:[EDI+B0]
1000248B 3B97 AC000000 CMP EDX,DWORD PTR DS:[EDI+AC]
10002491 ^0F83 29FEFFFF JNB CShell.100022C0
10002497 ^E9 89FEFFFF JMP CShell.10002325
1000249C 8B07 MOV EAX,DWORD PTR DS:[EDI]
1000249E 8B50 04 MOV EDX,DWORD PTR DS:[EAX+4]
100024A1 53 PUSH EBX
100024A2 8BCF MOV ECX,EDI
100024A4 FFD2 CALL EDX
100024A6 8B4C24 78 MOV ECX,DWORD PTR SS:[ESP+78]
100024AA 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
100024B1 59 POP ECX
100024B2 5E POP ESI
100024B3 5B POP EBX
100024B4 8BE5 MOV ESP,EBP
100024B6 5D POP EBP
100024B7 C3 RETN
100024B8 CC INT3
100024B9 CC INT3
100024BA CC INT3
100024BB CC INT3
100024BC CC INT3
100024BD CC INT3
100024BE CC INT3
100024BF CC INT3
100024C0 F605 B464C410 01 TEST BYTE PTR DS:[10C464B4],1
100024C7 75 1E JNZ SHORT CShell.100024E7
100024C9 830D B464C410 01 OR DWORD PTR DS:[10C464B4],1
100024D0 68 20E22910 PUSH CShell.1029E220
100024D5 C705 B064C410 00>MOV DWORD PTR DS:[10C464B0],0
100024DF E8 738B2800 CALL CShell.1028B057
100024E4 83C4 04 ADD ESP,4
100024E7 A1 B064C410 MOV EAX,DWORD PTR DS:[10C464B0]
100024EC 85C0 TEST EAX,EAX
100024EE 74 13 JE SHORT CShell.10002503
100024F0 6A 00 PUSH 0
100024F2 50 PUSH EAX
100024F3 90 NOP
100024F4 E8 2BBC3365 CALL ADVAPI32.CryptReleaseContext
100024F9 C705 B064C410 00>MOV DWORD PTR DS:[10C464B0],0
10002503 68 000000F0 PUSH F0000000
10002508 6A 01 PUSH 1
1000250A 6A 00 PUSH 0
1000250C 6A 00 PUSH 0
1000250E 68 B064C410 PUSH CShell.10C464B0
10002513 90 NOP
10002514 E8 C46C3365 CALL ADVAPI32.CryptAcquireContextA
10002519 85C0 TEST EAX,EAX
1000251B 75 03 JNZ SHORT CShell.10002520
1000251D 32C0 XOR AL,AL
1000251F C3 RETN
10002520 C705 6464C410 B0>MOV DWORD PTR DS:[10C46464],CShell.10C46>
1000252A B0 01 MOV AL,1
1000252C C3 RETN
1000252D CC INT3
1000252E CC INT3
1000252F CC INT3
10002530 53 PUSH EBX
10002531 8B5C24 0C MOV EBX,DWORD PTR SS:[ESP+C]
10002535 85DB TEST EBX,EBX
10002537 56 PUSH ESI
10002538 8BF1 MOV ESI,ECX
1000253A 75 07 JNZ SHORT CShell.10002543
1000253C 5E POP ESI
1000253D 32C0 XOR AL,AL
1000253F 5B POP EBX
10002540 C2 0C00 RETN 0C
10002543 55 PUSH EBP
10002544 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18]
10002548 83FD 02 CMP EBP,2
1000254B 72 45 JB SHORT CShell.10002592
1000254D 57 PUSH EDI
1000254E 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14]
10002552 83BCBE 9C000000 >CMP DWORD PTR DS:[ESI+EDI*4+9C],0
1000255A 75 20 JNZ SHORT CShell.1000257C
1000255C 6A 2C PUSH 2C
1000255E E8 018A2800 CALL CShell.1028AF64
10002563 83C4 04 ADD ESP,4
10002566 85C0 TEST EAX,EAX
10002568 74 09 JE SHORT CShell.10002573
1000256A C740 08 00000000 MOV DWORD PTR DS:[EAX+8],0
10002571 EB 02 JMP SHORT CShell.10002575
10002573 33C0 XOR EAX,EAX
10002575 8984BE 9C000000 MOV DWORD PTR DS:[ESI+EDI*4+9C],EAX
1000257C 8B84BE 9C000000 MOV EAX,DWORD PTR DS:[ESI+EDI*4+9C]
10002583 85C0 TEST EAX,EAX
10002585 5F POP EDI
10002586 74 12 JE SHORT CShell.1000259A
10002588 55 PUSH EBP
10002589 E8 92030000 CALL CShell.10002920
1000258E 84C0 TEST AL,AL
10002590 75 08 JNZ SHORT CShell.1000259A
10002592 5D POP EBP
10002593 5E POP ESI
10002594 32C0 XOR AL,AL
10002596 5B POP EBX
10002597 C2 0C00 RETN 0C
1000259A 5D POP EBP
1000259B 5E POP ESI
1000259C B0 01 MOV AL,1
1000259E 5B POP EBX
1000259F C2 0C00 RETN 0C
100025A2 CC INT3
100025A3 CC INT3
100025A4 CC INT3
100025A5 CC INT3
100025A6 CC INT3
100025A7 CC INT3
100025A8 CC INT3
100025A9 CC INT3
100025AA CC INT3
100025AB CC INT3
100025AC CC INT3
100025AD CC INT3
100025AE CC INT3
100025AF CC INT3
100025B0 6A FF PUSH -1
100025B2 68 E0C52910 PUSH CShell.1029C5E0
100025B7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
100025BD 50 PUSH EAX
100025BE 83EC 38 SUB ESP,38
100025C1 53 PUSH EBX
100025C2 55 PUSH EBP
100025C3 56 PUSH ESI
100025C4 57 PUSH EDI
100025C5 A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
100025CA 33C4 XOR EAX,ESP
100025CC 50 PUSH EAX
100025CD 8D4424 4C LEA EAX,DWORD PTR SS:[ESP+4C]
100025D1 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
100025D7 8BF9 MOV EDI,ECX
100025D9 8B6C24 5C MOV EBP,DWORD PTR SS:[ESP+5C]
100025DD 8B8CAF 9C000000 MOV ECX,DWORD PTR DS:[EDI+EBP*4+9C]
100025E4 85C9 TEST ECX,ECX
100025E6 0F84 90000000 JE CShell.1000267C
100025EC 8D7424 30 LEA ESI,DWORD PTR SS:[ESP+30]
100025F0 E8 7B030000 CALL CShell.10002970
100025F5 8BF0 MOV ESI,EAX
100025F7 C74424 54 000000>MOV DWORD PTR SS:[ESP+54],0
100025FF 8B84AF 9C000000 MOV EAX,DWORD PTR DS:[EDI+EBP*4+9C]
10002606 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
1000260A E8 F1020000 CALL CShell.10002900
1000260F 8BC8 MOV ECX,EAX
10002611 C64424 54 01 MOV BYTE PTR SS:[ESP+54],1
10002616 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14]
10002619 BF 10000000 MOV EDI,10
1000261E 397E 18 CMP DWORD PTR DS:[ESI+18],EDI
10002621 72 05 JB SHORT CShell.10002628
10002623 8B56 04 MOV EDX,DWORD PTR DS:[ESI+4]
10002626 EB 03 JMP SHORT CShell.1000262B
10002628 8D56 04 LEA EDX,DWORD PTR DS:[ESI+4]
1000262B 50 PUSH EAX
1000262C 8B41 14 MOV EAX,DWORD PTR DS:[ECX+14]
1000262F E8 4C010000 CALL CShell.10002780
10002634 85C0 TEST EAX,EAX
10002636 0F94C3 SETE BL
10002639 397C24 2C CMP DWORD PTR SS:[ESP+2C],EDI
1000263D 72 0D JB SHORT CShell.1000264C
1000263F 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18]
10002643 50 PUSH EAX
10002644 E8 CB882800 CALL CShell.1028AF14
10002649 83C4 04 ADD ESP,4
1000264C 397C24 48 CMP DWORD PTR SS:[ESP+48],EDI
10002650 C74424 2C 0F0000>MOV DWORD PTR SS:[ESP+2C],0F
10002658 C74424 28 000000>MOV DWORD PTR SS:[ESP+28],0
10002660 C64424 18 00 MOV BYTE PTR SS:[ESP+18],0
10002665 72 0D JB SHORT CShell.10002674
10002667 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+34]
1000266B 51 PUSH ECX
1000266C E8 A3882800 CALL CShell.1028AF14
10002671 83C4 04 ADD ESP,4
10002674 84DB TEST BL,BL
10002676 74 04 JE SHORT CShell.1000267C
10002678 B0 01 MOV AL,1
1000267A EB 02 JMP SHORT CShell.1000267E
1000267C 32C0 XOR AL,AL
1000267E 8B4C24 4C MOV ECX,DWORD PTR SS:[ESP+4C]
10002682 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
10002689 59 POP ECX
1000268A 5F POP EDI
1000268B 5E POP ESI
1000268C 5D POP EBP
1000268D 5B POP EBX
1000268E 83C4 44 ADD ESP,44
10002691 C2 0400 RETN 4
10002694 CC INT3
10002695 CC INT3
10002696 CC INT3
10002697 CC INT3
10002698 CC INT3
10002699 CC INT3
1000269A CC INT3
1000269B CC INT3
1000269C CC INT3
1000269D CC INT3
1000269E CC INT3
1000269F CC INT3
100026A0 6A FF PUSH -1
100026A2 68 48C42910 PUSH CShell.1029C448
100026A7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
100026AD 50 PUSH EAX
100026AE 56 PUSH ESI
100026AF A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
100026B4 33C4 XOR EAX,ESP
100026B6 50 PUSH EAX
100026B7 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8]
100026BB 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
100026C1 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18]
100026C5 8D46 04 LEA EAX,DWORD PTR DS:[ESI+4]
100026C8 50 PUSH EAX
100026C9 C706 287B2E10 MOV DWORD PTR DS:[ESI],CShell.102E7B28
100026CF 90 NOP
100026D0 E8 6D059467 CALL ntdll.RtlInitializeCriticalSection
100026D5 C74424 10 000000>MOV DWORD PTR SS:[ESP+10],0
100026DD C706 407B2E10 MOV DWORD PTR DS:[ESI],CShell.102E7B40
100026E3 E8 08010000 CALL CShell.100027F0
100026E8 8946 20 MOV DWORD PTR DS:[ESI+20],EAX
100026EB C746 24 00000000 MOV DWORD PTR DS:[ESI+24],0
100026F2 8BC6 MOV EAX,ESI
100026F4 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
100026F8 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
100026FF 59 POP ECX
10002700 5E POP ESI
10002701 83C4 0C ADD ESP,0C
10002704 C2 0400 RETN 4
10002707 CC INT3
10002708 CC INT3
10002709 CC INT3
1000270A CC INT3
1000270B CC INT3
1000270C CC INT3
1000270D CC INT3
1000270E CC INT3
1000270F CC INT3
10002710 56 PUSH ESI
10002711 57 PUSH EDI
10002712 8BF9 MOV EDI,ECX
10002714 8BF7 MOV ESI,EDI
10002716 C707 407B2E10 MOV DWORD PTR DS:[EDI],CShell.102E7B40
1000271C E8 3F010000 CALL CShell.10002860
10002721 8D77 1C LEA ESI,DWORD PTR DS:[EDI+1C]
10002724 E8 E7000000 CALL CShell.10002810
10002729 C707 287B2E10 MOV DWORD PTR DS:[EDI],CShell.102E7B28
1000272F 83C7 04 ADD EDI,4
10002732 57 PUSH EDI
10002733 90 NOP
10002734 E8 BC1E9467 CALL ntdll.RtlDeleteCriticalSection
10002739 5F POP EDI
1000273A 5E POP ESI
1000273B C3 RETN
1000273C CC INT3
1000273D CC INT3
1000273E CC INT3
1000273F CC INT3
10002740 56 PUSH ESI
10002741 57 PUSH EDI
10002742 8BF9 MOV EDI,ECX
10002744 8BF7 MOV ESI,EDI
10002746 C707 407B2E10 MOV DWORD PTR DS:[EDI],CShell.102E7B40
1000274C E8 0F010000 CALL CShell.10002860
10002751 8D77 1C LEA ESI,DWORD PTR DS:[EDI+1C]
10002754 E8 B7000000 CALL CShell.10002810
10002759 8D47 04 LEA EAX,DWORD PTR DS:[EDI+4]
1000275C 50 PUSH EAX
1000275D C707 287B2E10 MOV DWORD PTR DS:[EDI],CShell.102E7B28
10002763 90 NOP
10002764 E8 8C1E9467 CALL ntdll.RtlDeleteCriticalSection
10002769 F64424 0C 01 TEST BYTE PTR SS:[ESP+C],1
1000276E 74 09 JE SHORT CShell.10002779
10002770 57 PUSH EDI
10002771 E8 9E872800 CALL CShell.1028AF14
10002776 83C4 04 ADD ESP,4
10002779 8BC7 MOV EAX,EDI
1000277B 5F POP EDI
1000277C 5E POP ESI
1000277D C2 0400 RETN 4
10002780 55 PUSH EBP
10002781 8B6C24 08 MOV EBP,DWORD PTR SS:[ESP+8]
10002785 56 PUSH ESI
10002786 57 PUSH EDI
10002787 8BF8 MOV EDI,EAX
10002789 8B41 14 MOV EAX,DWORD PTR DS:[ECX+14]
1000278C 3BC7 CMP EAX,EDI
1000278E 73 02 JNB SHORT CShell.10002792
10002790 8BF8 MOV EDI,EAX
10002792 3BFD CMP EDI,EBP
10002794 8BC7 MOV EAX,EDI
10002796 72 02 JB SHORT CShell.1000279A
10002798 8BC5 MOV EAX,EBP
1000279A 8379 18 10 CMP DWORD PTR DS:[ECX+18],10
1000279E 72 05 JB SHORT CShell.100027A5
100027A0 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]
100027A3 EB 03 JMP SHORT CShell.100027A8
100027A5 83C1 04 ADD ECX,4
100027A8 85C0 TEST EAX,EAX
100027AA 8BF2 MOV ESI,EDX
100027AC 76 26 JBE SHORT CShell.100027D4
100027AE 8BFF MOV EDI,EDI
100027B0 8A11 MOV DL,BYTE PTR DS:[ECX]
100027B2 3A16 CMP DL,BYTE PTR DS:[ESI]
100027B4 75 0F JNZ SHORT CShell.100027C5
100027B6 83E8 01 SUB EAX,1
100027B9 83C1 01 ADD ECX,1
100027BC 83C6 01 ADD ESI,1
100027BF 85C0 TEST EAX,EAX
100027C1 ^77 ED JA SHORT CShell.100027B0
100027C3 EB 0F JMP SHORT CShell.100027D4
100027C5 0FB601 MOVZX EAX,BYTE PTR DS:[ECX]
100027C8 3A06 CMP AL,BYTE PTR DS:[ESI]
100027CA 1BC0 SBB EAX,EAX
100027CC 83E0 FE AND EAX,FFFFFFFE
100027CF 83C0 01 ADD EAX,1
100027D2 75 14 JNZ SHORT CShell.100027E8
100027D4 3BFD CMP EDI,EBP
100027D6 73 09 JNB SHORT CShell.100027E1
100027D8 5F POP EDI
100027D9 5E POP ESI
100027DA 83C8 FF OR EAX,FFFFFFFF
100027DD 5D POP EBP
100027DE C2 0400 RETN 4
100027E1 33C0 XOR EAX,EAX
100027E3 3BFD CMP EDI,EBP
100027E5 0F95C0 SETNE AL
100027E8 5F POP EDI
100027E9 5E POP ESI
100027EA 5D POP EBP
100027EB C2 0400 RETN 4
100027EE CC INT3
100027EF CC INT3
100027F0 B9 01000000 MOV ECX,1
100027F5 E8 B6000000 CALL CShell.100028B0
100027FA 85C0 TEST EAX,EAX
100027FC 74 02 JE SHORT CShell.10002800
100027FE 8900 MOV DWORD PTR DS:[EAX],EAX
10002800 8D48 04 LEA ECX,DWORD PTR DS:[EAX+4]
10002803 85C9 TEST ECX,ECX
10002805 74 02 JE SHORT CShell.10002809
10002807 8901 MOV DWORD PTR DS:[ECX],EAX
10002809 C3 RETN
1000280A CC INT3
1000280B CC INT3
1000280C CC INT3
1000280D CC INT3
1000280E CC INT3
1000280F CC INT3
10002810 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
10002813 8B01 MOV EAX,DWORD PTR DS:[ECX]
10002815 8909 MOV DWORD PTR DS:[ECX],ECX
10002817 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
1000281A 8949 04 MOV DWORD PTR DS:[ECX+4],ECX
1000281D 3B46 04 CMP EAX,DWORD PTR DS:[ESI+4]
10002820 C746 08 00000000 MOV DWORD PTR DS:[ESI+8],0
10002827 74 1A JE SHORT CShell.10002843
10002829 57 PUSH EDI
1000282A 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
10002830 8B38 MOV EDI,DWORD PTR DS:[EAX]
10002832 50 PUSH EAX
10002833 E8 DC862800 CALL CShell.1028AF14
10002838 83C4 04 ADD ESP,4
1000283B 3B7E 04 CMP EDI,DWORD PTR DS:[ESI+4]
1000283E 8BC7 MOV EAX,EDI
10002840 ^75 EE JNZ SHORT CShell.10002830
10002842 5F POP EDI
10002843 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10002846 50 PUSH EAX
10002847 E8 C8862800 CALL CShell.1028AF14
1000284C 83C4 04 ADD ESP,4
1000284F C746 04 00000000 MOV DWORD PTR DS:[ESI+4],0
10002856 C3 RETN
10002857 CC INT3
10002858 CC INT3
10002859 CC INT3
1000285A CC INT3
1000285B CC INT3
1000285C CC INT3
1000285D CC INT3
1000285E CC INT3
1000285F CC INT3
10002860 53 PUSH EBX
10002861 8D5E 04 LEA EBX,DWORD PTR DS:[ESI+4]
10002864 53 PUSH EBX
10002865 90 NOP
10002866 E8 45FA9267 CALL ntdll.RtlEnterCriticalSection
1000286B 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+20]
1000286E 8B01 MOV EAX,DWORD PTR DS:[ECX]
10002870 8909 MOV DWORD PTR DS:[ECX],ECX
10002872 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+20]
10002875 8949 04 MOV DWORD PTR DS:[ECX+4],ECX
10002878 3B46 20 CMP EAX,DWORD PTR DS:[ESI+20]
1000287B C746 24 00000000 MOV DWORD PTR DS:[ESI+24],0
10002882 74 14 JE SHORT CShell.10002898
10002884 57 PUSH EDI
10002885 8B38 MOV EDI,DWORD PTR DS:[EAX]
10002887 50 PUSH EAX
10002888 E8 87862800 CALL CShell.1028AF14
1000288D 83C4 04 ADD ESP,4
10002890 3B7E 20 CMP EDI,DWORD PTR DS:[ESI+20]
10002893 8BC7 MOV EAX,EDI
10002895 ^75 EE JNZ SHORT CShell.10002885
10002897 5F POP EDI
10002898 53 PUSH EBX
10002899 90 NOP
1000289A E8 D1F99267 CALL ntdll.RtlLeaveCriticalSection
1000289F 5B POP EBX
100028A0 C3 RETN
100028A1 CC INT3
100028A2 CC INT3
100028A3 CC INT3
100028A4 CC INT3
100028A5 CC INT3
100028A6 CC INT3
100028A7 CC INT3
100028A8 CC INT3
100028A9 CC INT3
100028AA CC INT3
100028AB CC INT3
100028AC CC INT3
100028AD CC INT3
100028AE CC INT3
100028AF CC INT3
100028B0 83C8 FF OR EAX,FFFFFFFF
100028B3 33D2 XOR EDX,EDX
100028B5 F7F1 DIV ECX
100028B7 83EC 10 SUB ESP,10
100028BA 83F8 0C CMP EAX,0C
100028BD 73 2D JNB SHORT CShell.100028EC
100028BF 8D0424 LEA EAX,DWORD PTR SS:[ESP]
100028C2 50 PUSH EAX
100028C3 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
100028C7 C74424 04 000000>MOV DWORD PTR SS:[ESP+4],0
100028CF 90 NOP
100028D0 E8 1849DE5F CALL MSVCR80.??0exception@STD@@QAE@ABQBD>
100028D5 68 74523010 PUSH CShell.10305274
100028DA 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
100028DE 51 PUSH ECX
100028DF C74424 0C A4002A>MOV DWORD PTR SS:[ESP+C],CShell.102A00A4
100028E7 E8 9C872800 CALL CShell.1028B088
100028EC 8D1449 LEA EDX,DWORD PTR DS:[ECX+ECX*2]
100028EF 03D2 ADD EDX,EDX
100028F1 03D2 ADD EDX,EDX
100028F3 52 PUSH EDX
100028F4 E8 6B862800 CALL CShell.1028AF64
100028F9 83C4 04 ADD ESP,4
100028FC 83C4 10 ADD ESP,10
100028FF C3 RETN
10002900 51 PUSH ECX
10002901 57 PUSH EDI
10002902 83C0 08 ADD EAX,8
10002905 8BF9 MOV EDI,ECX
10002907 50 PUSH EAX
10002908 C74424 08 000000>MOV DWORD PTR SS:[ESP+8],0
10002910 E8 4BEEFFFF CALL CShell.10001760
10002915 8BC7 MOV EAX,EDI
10002917 5F POP EDI
10002918 59 POP ECX
10002919 C3 RETN
1000291A CC INT3
1000291B CC INT3
1000291C CC INT3
1000291D CC INT3
1000291E CC INT3
1000291F CC INT3
10002920 85DB TEST EBX,EBX
10002922 55 PUSH EBP
10002923 8B6C24 08 MOV EBP,DWORD PTR SS:[ESP+8]
10002927 56 PUSH ESI
10002928 8BF0 MOV ESI,EAX
1000292A 75 07 JNZ SHORT CShell.10002933
1000292C 5E POP ESI
1000292D 32C0 XOR AL,AL
1000292F 5D POP EBP
10002930 C2 0400 RETN 4
10002933 83FD 02 CMP EBP,2
10002936 ^72 F4 JB SHORT CShell.1000292C
10002938 57 PUSH EDI
10002939 8D7E 08 LEA EDI,DWORD PTR DS:[ESI+8]
1000293C 8BC7 MOV EAX,EDI
1000293E 896E 04 MOV DWORD PTR DS:[ESI+4],EBP
10002941 891E MOV DWORD PTR DS:[ESI],EBX
10002943 E8 28EDFFFF CALL CShell.10001670
10002948 84C0 TEST AL,AL
1000294A 75 06 JNZ SHORT CShell.10002952
1000294C 5F POP EDI
1000294D 5E POP ESI
1000294E 5D POP EBP
1000294F C2 0400 RETN 4
10002952 83C6 0C ADD ESI,0C
10002955 56 PUSH ESI
10002956 53 PUSH EBX
10002957 8BC5 MOV EAX,EBP
10002959 E8 82EDFFFF CALL CShell.100016E0
1000295E 5F POP EDI
1000295F 5E POP ESI
10002960 5D POP EBP
10002961 C2 0400 RETN 4
10002964 CC INT3
10002965 CC INT3
10002966 CC INT3
10002967 CC INT3
10002968 CC INT3
10002969 CC INT3
1000296A CC INT3
1000296B CC INT3
1000296C CC INT3
1000296D CC INT3
1000296E CC INT3
1000296F CC INT3
10002970 6A FF PUSH -1
10002972 68 A8C52910 PUSH CShell.1029C5A8
10002977 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
1000297D 50 PUSH EAX
1000297E 83EC 2C SUB ESP,2C
10002981 A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
10002986 33C4 XOR EAX,ESP
10002988 894424 28 MOV DWORD PTR SS:[ESP+28],EAX
1000298C 53 PUSH EBX
1000298D 57 PUSH EDI
1000298E A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
10002993 33C4 XOR EAX,ESP
10002995 50 PUSH EAX
10002996 8D4424 38 LEA EAX,DWORD PTR SS:[ESP+38]
1000299A 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
100029A0 33DB XOR EBX,EBX
100029A2 8BF9 MOV EDI,ECX
100029A4 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX
100029A8 391F CMP DWORD PTR DS:[EDI],EBX
100029AA 75 0F JNZ SHORT CShell.100029BB
100029AC C746 18 0F000000 MOV DWORD PTR DS:[ESI+18],0F
100029B3 895E 14 MOV DWORD PTR DS:[ESI+14],EBX
100029B6 885E 04 MOV BYTE PTR DS:[ESI+4],BL
100029B9 EB 6C JMP SHORT CShell.10002A27
100029BB 837F 04 02 CMP DWORD PTR DS:[EDI+4],2
100029BF ^72 EB JB SHORT CShell.100029AC
100029C1 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX
100029C5 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10]
100029C9 895C24 40 MOV DWORD PTR SS:[ESP+40],EBX
100029CD E8 9EECFFFF CALL CShell.10001670
100029D2 84C0 TEST AL,AL
100029D4 75 0F JNZ SHORT CShell.100029E5
100029D6 C746 18 0F000000 MOV DWORD PTR DS:[ESI+18],0F
100029DD 895E 14 MOV DWORD PTR DS:[ESI+14],EBX
100029E0 885E 04 MOV BYTE PTR DS:[ESI+4],BL
100029E3 EB 33 JMP SHORT CShell.10002A18
100029E5 8B0F MOV ECX,DWORD PTR DS:[EDI]
100029E7 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
100029EB 50 PUSH EAX
100029EC 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4]
100029EF 51 PUSH ECX
100029F0 8D7C24 18 LEA EDI,DWORD PTR SS:[ESP+18]
100029F4 E8 E7ECFFFF CALL CShell.100016E0
100029F9 84C0 TEST AL,AL
100029FB 75 0F JNZ SHORT CShell.10002A0C
100029FD C746 18 0F000000 MOV DWORD PTR DS:[ESI+18],0F
10002A04 895E 14 MOV DWORD PTR DS:[ESI+14],EBX
10002A07 885E 04 MOV BYTE PTR DS:[ESI+4],BL
10002A0A EB 0C JMP SHORT CShell.10002A18
10002A0C 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10]
10002A10 52 PUSH EDX
10002A11 8BFE MOV EDI,ESI
10002A13 E8 48EDFFFF CALL CShell.10001760
10002A18 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
10002A1C 3BC3 CMP EAX,EBX
10002A1E 74 07 JE SHORT CShell.10002A27
10002A20 50 PUSH EAX
10002A21 90 NOP
10002A22 E8 3FB53365 CALL ADVAPI32.CryptDestroyHash
10002A27 8BC6 MOV EAX,ESI
10002A29 8B4C24 38 MOV ECX,DWORD PTR SS:[ESP+38]
10002A2D 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
10002A34 59 POP ECX
10002A35 5F POP EDI
10002A36 5B POP EBX
10002A37 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28]
10002A3B 33CC XOR ECX,ESP
10002A3D E8 2E852800 CALL CShell.1028AF70
10002A42 83C4 38 ADD ESP,38
10002A45 C3 RETN
10002A46 CC INT3
10002A47 CC INT3
10002A48 CC INT3
10002A49 CC INT3
10002A4A CC INT3
10002A4B CC INT3
10002A4C CC INT3
10002A4D CC INT3
10002A4E CC INT3
10002A4F CC INT3
10002A50 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
10002A54 85C0 TEST EAX,EAX
10002A56 56 PUSH ESI
10002A57 8BF1 MOV ESI,ECX
10002A59 75 07 JNZ SHORT CShell.10002A62
10002A5B 83C8 FF OR EAX,FFFFFFFF
10002A5E 5E POP ESI
10002A5F C2 0800 RETN 8
10002A62 57 PUSH EDI
10002A63 8D7E 08 LEA EDI,DWORD PTR DS:[ESI+8]
10002A66 57 PUSH EDI
10002A67 6A 00 PUSH 0
10002A69 56 PUSH ESI
10002A6A 68 A02C0010 PUSH CShell.10002CA0
10002A6F 6A 00 PUSH 0
10002A71 6A 00 PUSH 0
10002A73 8986 18010000 MOV DWORD PTR DS:[ESI+118],EAX
10002A79 90 NOP
10002A7A E8 C9FFDB5F CALL MSVCR80._beginthreadex
10002A7F 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28]
10002A83 83C4 18 ADD ESP,18
10002A86 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
10002A89 8B07 MOV EAX,DWORD PTR DS:[EDI]
10002A8B 50 PUSH EAX
10002A8C 56 PUSH ESI
10002A8D E8 5E010000 CALL CShell.10002BF0
10002A92 8B07 MOV EAX,DWORD PTR DS:[EDI]
10002A94 5F POP EDI
10002A95 5E POP ESI
10002A96 C2 0800 RETN 8
10002A99 CC INT3
10002A9A CC INT3
10002A9B CC INT3
10002A9C CC INT3
10002A9D CC INT3
10002A9E CC INT3
10002A9F CC INT3
10002AA0 57 PUSH EDI
10002AA1 8BB9 18010000 MOV EDI,DWORD PTR DS:[ECX+118]
10002AA7 E8 74F7FFFF CALL CShell.10002220
10002AAC 5F POP EDI
10002AAD C3 RETN
10002AAE CC INT3
10002AAF CC INT3
10002AB0 57 PUSH EDI
10002AB1 68 04010000 PUSH 104
10002AB6 8D46 0C LEA EAX,DWORD PTR DS:[ESI+C]
10002AB9 6A 00 PUSH 0
10002ABB 50 PUSH EAX
10002ABC C706 5C7B2E10 MOV DWORD PTR DS:[ESI],CShell.102E7B5C
10002AC2 C746 04 FFFFFFFF MOV DWORD PTR DS:[ESI+4],-1
10002AC9 C746 08 00000000 MOV DWORD PTR DS:[ESI+8],0
10002AD0 E8 D7842800 CALL CShell.1028AFAC
10002AD5 8B3D 7CF12910 MOV EDI,DWORD PTR DS:[1029F17C] ; kernel32.CreateEventA
10002ADB 83C4 0C ADD ESP,0C
10002ADE 6A 00 PUSH 0
10002AE0 6A 00 PUSH 0
10002AE2 6A 00 PUSH 0
10002AE4 6A 00 PUSH 0
10002AE6 FFD7 CALL EDI
10002AE8 6A 00 PUSH 0
10002AEA 6A 00 PUSH 0
10002AEC 6A 00 PUSH 0
10002AEE 6A 00 PUSH 0
10002AF0 8986 10010000 MOV DWORD PTR DS:[ESI+110],EAX
10002AF6 FFD7 CALL EDI
10002AF8 6A 00 PUSH 0
10002AFA 6A 00 PUSH 0
10002AFC 6A 00 PUSH 0
10002AFE 6A 00 PUSH 0
10002B00 A3 5464C410 MOV DWORD PTR DS:[10C46454],EAX
10002B05 FFD7 CALL EDI
10002B07 8986 14010000 MOV DWORD PTR DS:[ESI+114],EAX
10002B0D 8BC6 MOV EAX,ESI
10002B0F 5F POP EDI
10002B10 C3 RETN
10002B11 CC INT3
10002B12 CC INT3
10002B13 CC INT3
10002B14 CC INT3
10002B15 CC INT3
10002B16 CC INT3
10002B17 CC INT3
10002B18 CC INT3
10002B19 CC INT3
10002B1A CC INT3
10002B1B CC INT3
10002B1C CC INT3
10002B1D CC INT3
10002B1E CC INT3
10002B1F CC INT3
10002B20 56 PUSH ESI
10002B21 8BF1 MOV ESI,ECX
10002B23 8B86 10010000 MOV EAX,DWORD PTR DS:[ESI+110]
10002B29 57 PUSH EDI
10002B2A 8B3D 74F02910 MOV EDI,DWORD PTR DS:[1029F074] ; kernel32.CloseHandle
10002B30 50 PUSH EAX
10002B31 C706 5C7B2E10 MOV DWORD PTR DS:[ESI],CShell.102E7B5C
10002B37 FFD7 CALL EDI
10002B39 8B0D 5464C410 MOV ECX,DWORD PTR DS:[10C46454]
10002B3F 51 PUSH ECX
10002B40 FFD7 CALL EDI
10002B42 8B96 14010000 MOV EDX,DWORD PTR DS:[ESI+114]
10002B48 52 PUSH EDX
10002B49 FFD7 CALL EDI
10002B4B 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10002B4E 50 PUSH EAX
10002B4F FFD7 CALL EDI
10002B51 F64424 0C 01 TEST BYTE PTR SS:[ESP+C],1
10002B56 74 09 JE SHORT CShell.10002B61
10002B58 56 PUSH ESI
10002B59 E8 B6832800 CALL CShell.1028AF14
10002B5E 83C4 04 ADD ESP,4
10002B61 5F POP EDI
10002B62 8BC6 MOV EAX,ESI
10002B64 5E POP ESI
10002B65 C2 0400 RETN 4
10002B68 CC INT3
10002B69 CC INT3
10002B6A CC INT3
10002B6B CC INT3
10002B6C CC INT3
10002B6D CC INT3
10002B6E CC INT3
10002B6F CC INT3
10002B70 837C24 04 00 CMP DWORD PTR SS:[ESP+4],0
10002B75 56 PUSH ESI
10002B76 8BF1 MOV ESI,ECX
10002B78 75 07 JNZ SHORT CShell.10002B81
10002B7A 83C8 FF OR EAX,FFFFFFFF
10002B7D 5E POP ESI
10002B7E C2 0800 RETN 8
10002B81 57 PUSH EDI
10002B82 8D7E 08 LEA EDI,DWORD PTR DS:[ESI+8]
10002B85 57 PUSH EDI
10002B86 6A 00 PUSH 0
10002B88 56 PUSH ESI
10002B89 68 A02C0010 PUSH CShell.10002CA0
10002B8E 6A 00 PUSH 0
10002B90 6A 00 PUSH 0
10002B92 90 NOP
10002B93 E8 B0FEDB5F CALL MSVCR80._beginthreadex
10002B98 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28]
10002B9C 83C4 18 ADD ESP,18
10002B9F 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
10002BA2 8B07 MOV EAX,DWORD PTR DS:[EDI]
10002BA4 50 PUSH EAX
10002BA5 56 PUSH ESI
10002BA6 E8 45000000 CALL CShell.10002BF0
10002BAB 8B07 MOV EAX,DWORD PTR DS:[EDI]
10002BAD 5F POP EDI
10002BAE 5E POP ESI
10002BAF C2 0800 RETN 8
10002BB2 CC INT3
10002BB3 CC INT3
10002BB4 CC INT3
10002BB5 CC INT3
10002BB6 CC INT3
10002BB7 CC INT3
10002BB8 CC INT3
10002BB9 CC INT3
10002BBA CC INT3
10002BBB CC INT3
10002BBC CC INT3
10002BBD CC INT3
10002BBE CC INT3
10002BBF CC INT3
10002BC0 8B81 10010000 MOV EAX,DWORD PTR DS:[ECX+110]
10002BC6 50 PUSH EAX
10002BC7 90 NOP
10002BC8 E8 F8EA1C65 CALL kernel32.SetEvent
10002BCD 8B0D 5464C410 MOV ECX,DWORD PTR DS:[10C46454]
10002BD3 6A FF PUSH -1
10002BD5 51 PUSH ECX
10002BD6 90 NOP
10002BD7 E8 5AE51C65 CALL kernel32.WaitForSingleObject
10002BDC B8 01000000 MOV EAX,1
10002BE1 C3 RETN
10002BE2 CC INT3
10002BE3 CC INT3
10002BE4 CC INT3
10002BE5 CC INT3
10002BE6 CC INT3
10002BE7 CC INT3
10002BE8 CC INT3
10002BE9 CC INT3
10002BEA CC INT3
10002BEB CC INT3
10002BEC CC INT3
10002BED CC INT3
10002BEE CC INT3
10002BEF CC INT3
10002BF0 55 PUSH EBP
10002BF1 8BEC MOV EBP,ESP
10002BF3 6A FE PUSH -2
10002BF5 68 88523010 PUSH CShell.10305288
10002BFA 68 A8B22810 PUSH CShell.1028B2A8
10002BFF 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
10002C05 50 PUSH EAX
10002C06 83EC 18 SUB ESP,18
10002C09 53 PUSH EBX
10002C0A 56 PUSH ESI
10002C0B 57 PUSH EDI
10002C0C A1 681B3110 MOV EAX,DWORD PTR DS:[10311B68]
10002C11 3145 F8 XOR DWORD PTR SS:[EBP-8],EAX
10002C14 33C5 XOR EAX,EBP
10002C16 50 PUSH EAX
10002C17 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
10002C1A 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
10002C20 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
10002C23 C745 D8 00100000 MOV DWORD PTR SS:[EBP-28],1000
10002C2A 894D DC MOV DWORD PTR SS:[EBP-24],ECX
10002C2D 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
10002C30 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
10002C33 33DB XOR EBX,EBX
10002C35 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX
10002C38 8BC1 MOV EAX,ECX
10002C3A 8D70 01 LEA ESI,DWORD PTR DS:[EAX+1]
10002C3D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10002C40 8A10 MOV DL,BYTE PTR DS:[EAX]
10002C42 83C0 01 ADD EAX,1
10002C45 3AD3 CMP DL,BL
10002C47 ^75 F7 JNZ SHORT CShell.10002C40
10002C49 2BC6 SUB EAX,ESI
10002C4B 50 PUSH EAX
10002C4C 51 PUSH ECX
10002C4D 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
10002C50 83C1 0C ADD ECX,0C
10002C53 51 PUSH ECX
10002C54 90 NOP
10002C55 E8 F6DAE05F CALL MSVCR80.strncpy
10002C5A 83C4 0C ADD ESP,0C
10002C5D 895D FC MOV DWORD PTR SS:[EBP-4],EBX
10002C60 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
10002C63 52 PUSH EDX
10002C64 6A 04 PUSH 4
10002C66 53 PUSH EBX
10002C67 68 88136D40 PUSH 406D1388
10002C6C 90 NOP
10002C6D E8 342C1D65 CALL kernel32.RaiseException
10002C72 EB 07 JMP SHORT CShell.10002C7B
10002C74 83C8 FF OR EAX,FFFFFFFF
10002C77 C3 RETN
10002C78 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
10002C7B C745 FC FEFFFFFF MOV DWORD PTR SS:[EBP-4],-2
10002C82 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
10002C85 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
10002C8C 59 POP ECX
10002C8D 5F POP EDI
10002C8E 5E POP ESI
10002C8F 5B POP EBX
10002C90 8BE5 MOV ESP,EBP
10002C92 5D POP EBP
10002C93 C2 0800 RETN 8
10002C96 CC INT3
10002C97 CC INT3
10002C98 CC INT3
10002C99 CC INT3
10002C9A CC INT3
10002C9B CC INT3
10002C9C CC INT3
10002C9D CC INT3
10002C9E CC INT3
10002C9F CC INT3
10002CA0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
10002CA4 8B01 MOV EAX,DWORD PTR DS:[ECX]
10002CA6 8B50 04 MOV EDX,DWORD PTR DS:[EAX+4]
10002CA9 FFD2 CALL EDX
10002CAB A1 5464C410 MOV EAX,DWORD PTR DS:[10C46454]
10002CB0 50 PUSH EAX
10002CB1 90 NOP
10002CB2 E8 0EEA1C65 CALL kernel32.SetEvent
10002CB7 33C0 XOR EAX,EAX
10002CB9 C2 0400 RETN 4
10002CBC CC INT3
10002CBD CC INT3
10002CBE CC INT3
10002CBF CC INT3
10002CC0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
10002CC4 56 PUSH ESI
10002CC5 50 PUSH EAX
10002CC6 8BF1 MOV ESI,ECX
10002CC8 E8 43D21E00 CALL CShell.101EFF10
10002CCD 33C0 XOR EAX,EAX
10002CCF C706 50F92910 MOV DWORD PTR DS:[ESI],CShell.1029F950
10002CD5 8986 D0000000 MOV DWORD PTR DS:[ESI+D0],EAX
10002CDB 8986 D4000000 MOV DWORD PTR DS:[ESI+D4],EAX
10002CE1 8986 D8000000 MOV DWORD PTR DS:[ESI+D8],EAX
10002CE7 8986 DC000000 MOV DWORD PTR DS:[ESI+DC],EAX
10002CED 8986 E0000000 MOV DWORD PTR DS:[ESI+E0],EAX
10002CF3 8986 E4000000 MOV DWORD PTR DS:[ESI+E4],EAX
10002CF9 8986 E8000000 MOV DWORD PTR DS:[ESI+E8],EAX
10002CFF 8BC6 MOV EAX,ESI
10002D01 5E POP ESI
10002D02 C2 0400 RETN 4
10002D05 CC INT3
10002D06 CC INT3
10002D07 CC INT3
10002D08 CC INT3
10002D09 CC INT3
10002D0A CC INT3
10002D0B CC INT3
10002D0C CC INT3
10002D0D CC INT3
10002D0E CC INT3
10002D0F CC INT3
10002D10 C701 50F92910 MOV DWORD PTR DS:[ECX],CShell.1029F950
10002D16 E9 65D11E00 JMP CShell.101EFE80
10002D1B CC INT3
10002D1C CC INT3
10002D1D CC INT3
10002D1E CC INT3
10002D1F CC INT3
10002D20 56 PUSH ESI
10002D21 57 PUSH EDI
10002D22 8D71 38 LEA ESI,DWORD PTR DS:[ECX+38]
10002D25 8DB9 D0000000 LEA EDI,DWORD PTR DS:[ECX+D0]
10002D2B B9 07000000 MOV ECX,7
10002D30 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
10002D32 5F POP EDI
10002D33 5E POP ESI
10002D34 C3 RETN
10002D35 CC INT3
10002D36 CC INT3
10002D37 CC INT3
10002D38 CC INT3
10002D39 CC INT3
10002D3A CC INT3
10002D3B CC INT3
10002D3C CC INT3
10002D3D CC INT3
10002D3E CC INT3
10002D3F CC INT3
10002D40 8D81 D0000000 LEA EAX,DWORD PTR DS:[ECX+D0]
10002D46 50 PUSH EAX
10002D47 E8 64D51E00 CALL CShell.101F02B0
10002D4C C3 RETN
10002D4D CC INT3
10002D4E CC INT3
10002D4F CC INT3
10002D50 33C0 XOR EAX,EAX
10002D52 83C1 38 ADD ECX,38
10002D55 8B11 MOV EDX,DWORD PTR DS:[ECX]
10002D57 3B91 98000000 CMP EDX,DWORD PTR DS:[ECX+98]
10002D5D 75 0E JNZ SHORT CShell.10002D6D
10002D5F 83C0 01 ADD EAX,1
10002D62 83C1 04 ADD ECX,4
10002D65 83F8 07 CMP EAX,7
10002D68 ^7C EB JL SHORT CShell.10002D55
10002D6A 32C0 XOR AL,AL
10002D6C C3 RETN
10002D6D B0 01 MOV AL,1
10002D6F C3 RETN
10002D70 56 PUSH ESI
10002D71 8BF1 MOV ESI,ECX
10002D73 E8 98FFFFFF CALL CShell.10002D10
10002D78 F64424 08 01 TEST BYTE PTR SS:[ESP+8],1
10002D7D 74 09 JE SHORT CShell.10002D88
10002D7F 56 PUSH ESI
10002D80 E8 8F812800 CALL CShell.1028AF14
10002D85 83C4 04 ADD ESP,4
10002D88 8BC6 MOV EAX,ESI
10002D8A 5E POP ESI
10002D8B C2 0400 RETN 4
10002D8E CC INT3
10002D8F CC INT3
10002D90 56 PUSH ESI
10002D91 57 PUSH EDI
10002D92 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
10002D96 57 PUSH EDI
10002D97 8BF1 MOV ESI,ECX
10002D99 E8 02D71E00 CALL CShell.101F04A0
10002D9E C706 60F92910 MOV DWORD PTR DS:[ESI],CShell.1029F960
10002DA4 8A47 38 MOV AL,BYTE PTR DS:[EDI+38]
10002DA7 8846 60 MOV BYTE PTR DS:[ESI+60],AL
10002DAA 5F POP EDI
10002DAB 8BC6 MOV EAX,ESI
10002DAD 5E POP ESI
10002DAE C2 0400 RETN 4
10002DB1 CC INT3
10002DB2 CC INT3
10002DB3 CC INT3
10002DB4 CC INT3
10002DB5 CC INT3
10002DB6 CC INT3
10002DB7 CC INT3
10002DB8 CC INT3
10002DB9 CC INT3
10002DBA CC INT3
10002DBB CC INT3
10002DBC CC INT3
10002DBD CC INT3
10002DBE CC INT3
10002DBF CC INT3
10002DC0 C701 60F92910 MOV DWORD PTR DS:[ECX],CShell.1029F960
10002DC6 E9 55D61E00 JMP CShell.101F0420
10002DCB CC INT3
10002DCC CC INT3
10002DCD CC INT3
10002DCE CC INT3
10002DCF CC INT3
10002DD0 8A41 38 MOV AL,BYTE PTR DS:[ECX+38]
10002DD3 8841 60 MOV BYTE PTR DS:[ECX+60],AL
10002DD6 C3 RETN
10002DD7 CC INT3
10002DD8 CC INT3
10002DD9 CC INT3
10002DDA CC INT3
10002DDB CC INT3
10002DDC CC INT3
10002DDD CC INT3
10002DDE CC INT3
10002DDF CC INT3
10002DE0 8A41 60 MOV AL,BYTE PTR DS:[ECX+60]
10002DE3 8841 38 MOV BYTE PTR DS:[ECX+38],AL
10002DE6 C3 RETN
10002DE7 CC INT3
10002DE8 CC INT3
10002DE9 CC INT3
10002DEA CC INT3
10002DEB CC INT3
10002DEC CC INT3
10002DED CC INT3
10002DEE CC INT3
10002DEF CC INT3
10002DF0 8A41 60 MOV AL,BYTE PTR DS:[ECX+60]
10002DF3 33D2 XOR EDX,EDX
10002DF5 3A41 38 CMP AL,BYTE PTR DS:[ECX+38]
10002DF8 0F95C2 SETNE DL
10002DFB 8AC2 MOV AL,DL
10002DFD C3 RETN
10002DFE CC INT3
10002DFF CC INT3
10002E00 56 PUSH ESI
10002E01 8BF1 MOV ESI,ECX
10002E03 E8 B8FFFFFF CALL CShell.10002DC0
10002E08 F64424 08 01 TEST BYTE PTR SS:[ESP+8],1
10002E0D 74 09 JE SHORT CShell.10002E18
10002E0F 56 PUSH ESI
10002E10 E8 FF802800 CALL CShell.1028AF14
10002E15 83C4 04 ADD ESP,4
10002E18 8BC6 MOV EAX,ESI
10002E1A 5E POP ESI
10002E1B C2 0400 RETN 4
10002E1E CC INT3
10002E1F CC INT3
10002E20 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
10002E24 85C0 TEST EAX,EAX
10002E26 75 06 JNZ SHORT CShell.10002E2E
If Thats Not The Reason Just Say Lol
.
with that addie.. , or ? @{Banned}**HACKER**
Originally Posted by {Banned}**HACKER**
:P
