Function at 0x1c42be0
Capabilities:
Access peb ldr_data
Check os version
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1bc
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
je 0x1c43e93
lea eax, [ebp + 8]
pxor xmm0, xmm0
lea ecx, [ebp - 0x138]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov ebx, dword [eax]
mov dword [ebp - 0x1bc], ecx
push ecx
push ebx
call fcn.01c70540
add esp, 8
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + 0x40]
cmp esi, edi
je 0x1c42cb9
lea ebx, [ebp - 0x12c]
jmp 0x1c42c69
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
add esi, 0xc
cmp esi, edi
je 0x1c42cb4
movzx eax, byte [esi + 0xb]
mov ecx, esi
test al, al
jns 0x1c42c78
mov ecx, dword [esi]
mov eax, dword [esi + 4]
pxor xmm0, xmm0
movq qword [ebp - 0x12c], xmm0
mov dword [ebp - 0x124], 0
push ebx
push eax
push ecx
call fcn.01c84f90
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push ebx
call fcn.01c70540
add esp, 8
cmp byte [ebp - 0x121], 0
jns 0x1c42c62
jmp 0x1c42c54
lea eax, [ebp + 8]
mov ebx, dword [eax]
movzx eax, byte [ebx + 0x17]
test al, al
jns 0x1c42cc4
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1c42d32
lea eax, [ebx + 0xc]
lea edx, [ebp - 0x198]
mov byte [edx + 0xb], 8
mov dword [edx + 4], 0x65736162
mov dword [edx], 0x61746164
mov byte [edx + 8], 0
lea esi, [ebp - 0x12c]
mov ecx, esi
push eax
call fcn.01c49b50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.01c70540
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x1c42d1b
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c42d32
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
movzx eax, byte [ebx + 0x23]
test al, al
jns 0x1c42d3d
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x1c42dcc
lea edi, [ebx + 0x18]
push 0x10
call fcn.01c9515a
add esp, 4
lea edx, [ebp - 0x198]
mov dword [edx], eax
mov dword [edx + 8], 0x80000010
mov dword [edx + 4], 0xb
mov dword [eax + 7], 0x7269642d
mov dword [eax + 4], 0x2d736369
mov dword [eax], 0x7274656d
mov byte [eax + 0xb], 0
lea esi, [ebp - 0x12c]
mov ecx, esi
push edi
call fcn.01c49b50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.01c70540
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x1c42db5
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c42dcc
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
movzx eax, byte [ebx + 0x2f]
test al, al
js 0x1c42ea4
test eax, eax
je 0x1c42e8b
add ebx, 0x24
pxor xmm0, xmm0
lea edi, [ebp - 0x198]
movq qword [edi], xmm0
mov dword [edi + 8], 0
push edi
push eax
push ebx
call fcn.01c84f90
add esp, 0xc
lea edx, [ebp - 0x1a8]
mov byte [edx + 0xb], 3
movzx eax, word [0x1ce748a]
mov word [edx], ax
mov al, byte [0x1ce748c]
mov byte [edx + 2], al
mov byte [edx + 3], 0
lea esi, [ebp - 0x12c]
mov ecx, esi
push edi
call fcn.01c49b50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.01c70540
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x1c42e58
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x19d], 0
jns 0x1c42e6f
push dword [ebp - 0x1a8]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c42e86
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
lea eax, [ebp + 8]
mov ebx, dword [eax]
mov edi, dword [ebx + 0x30]
lea eax, [ebx + 0x34]
mov dword [ebp - 0x1c8], eax
cmp edi, eax
jne 0x1c430f5
jmp 0x1c43284
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1c42e8b
mov ebx, dword [ebx + 0x24]
jmp 0x1c42de3
mov dword [ebp - 0x1b8], esi
lea ecx, [esi + eax]
mov dword [ebp - 0x1c0], ecx
sub ecx, ebx
mov edx, 0x7ffffff6
sub edx, ebx
cmp edx, ecx
jb 0x1c43e90
mov dword [ebp - 0x1c4], eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x1b4], ecx
cmp byte [ebp - 0x1ac], 0
jns 0x1c42efa
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1b4], eax
mov esi, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c42f26
lea eax, [ebx + ebx]
mov ecx, dword [ebp - 0x1c0]
cmp ecx, eax
cmova eax, ecx
mov esi, eax
or esi, 7
inc esi
cmp eax, 0xb
mov eax, 0xb
cmovb esi, eax
push esi
call fcn.01c9515a
add esp, 4
mov ecx, dword [ebp - 0x1b8]
test ecx, ecx
mov dword [ebp - 0x1ac], eax
je 0x1c42f5b
push ecx
push dword [ebp - 0x1b4]
push eax
call fcn.01c994a0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b8]
add esp, 0xc
add ecx, eax
push dword [ebp - 0x1c4]
push dword [ebp - 0x1b0]
push ecx
call fcn.01c994a0
add esp, 0xc
cmp ebx, 0xa
je 0x1c42f85
push dword [ebp - 0x1b4]
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp - 0x144], ecx
or esi, 0x80000000
mov dword [ebp - 0x13c], esi
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x140], eax
add ecx, eax
mov byte [ecx], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], eax
movq xmm0, qword [ebp - 0x144]
movq qword [ebp - 0x1a8], xmm0
pxor xmm0, xmm0
movq qword [ebp - 0x144], xmm0
xor edx, edx
mov dword [ebp - 0x13c], edx
movzx eax, byte [ebp - 0x19d]
test al, al
cmovs eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a8]
lea esi, [ebp - 0x1a8]
cmovns ecx, esi
movq qword [ebp - 0x198], xmm0
mov dword [ebp - 0x190], edx
lea esi, [ebp - 0x198]
push esi
push eax
push ecx
call fcn.01c84f90
add esp, 0xc
mov dword [ebp - 0x150], 0x6f6e6e61
mov dword [ebp - 0x148], 0xa006e6f
mov dword [ebp - 0x14c], 0x69746174
lea ebx, [ebp - 0x12c]
mov ecx, ebx
lea edx, [ebp - 0x150]
push esi
call fcn.01c49b50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push ebx
call fcn.01c70540
add esp, 8
cmp byte [ebp - 0x121], 0
jns 0x1c43078
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x145], 0
jns 0x1c4308f
push dword [ebp - 0x150]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c430a6
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x19d], 0
jns 0x1c430bd
push dword [ebp - 0x1a8]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x139], 0
jns 0x1c430d4
push dword [ebp - 0x144]
call fcn.01c95155
add esp, 4
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1c4319d
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x1c430df
mov edi, eax
cmp eax, dword [ebp - 0x1c8]
je 0x1c4327f
movzx ecx, byte [edi + 0x1b]
mov ebx, ecx
test cl, cl
jns 0x1c43102
mov ebx, dword [edi + 0x14]
xor eax, eax
dec eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
lea eax, [ebx + 1]
cmp eax, 0x7ffffff8
jae 0x1c43e8d
mov dword [ebp - 0x1ac], ecx
cmp eax, 0xb
jb 0x1c431ab
mov dword [ebp - 0x1b0], ebx
mov ebx, eax
or ebx, 7
inc ebx
push ebx
mov dword [ebp - 0x1b8], eax
call fcn.01c9515a
add esp, 4
mov esi, eax
or ebx, 0x80000000
mov dword [ebp - 0x13c], ebx
mov ebx, dword [ebp - 0x1b0]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x140], eax
lea eax, [edi + 0x10]
cmp byte [ebp - 0x1ac], 0
jns 0x1c4317f
mov eax, dword [eax]
push ebx
push eax
push esi
call fcn.01c994a0
add esp, 0xc
mov word [esi + ebx], 0x3d
movzx edx, byte [edi + 0x27]
test dl, dl
js 0x1c431d3
lea eax, [edi + 0x1c]
jmp 0x1c431d9
mov eax, dword [edi + 8]
cmp dword [eax], edi
mov edi, eax
jne 0x1c4319d
jmp 0x1c430e7
pxor xmm0, xmm0
movq qword [ebp - 0x144], xmm0
mov dword [ebp - 0x13c], 0
mov byte [ebp - 0x139], al
lea esi, [ebp - 0x144]
test ebx, ebx
jne 0x1c43171
jmp 0x1c4318a
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x1b0], eax
movzx eax, byte [ebp - 0x139]
mov ebx, 0xa
mov esi, eax
mov dword [ebp - 0x1ac], eax
test al, al
jns 0x1c4320b
mov ebx, dword [ebp - 0x13c]
mov ecx, 0x7fffffff
and ebx, ecx
dec ebx
mov esi, dword [ebp - 0x140]
mov ecx, ebx
sub ecx, esi
mov eax, edx
cmp ecx, edx
jb 0x1c42eb3
test eax, eax
je 0x1c42fae
lea ecx, [ebp - 0x144]
cmp byte [ebp - 0x1ac], 0
jns 0x1c43236
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x1ac], ecx
lea eax, [ecx + esi]
mov ebx, edx
push edx
push dword [ebp - 0x1b0]
push eax
call fcn.01c994a0
mov ecx, esi
add esp, 0xc
add ecx, ebx
cmp byte [ebp - 0x139], 0
js 0x1c43277
mov eax, ecx
and al, 0x7f
mov byte [ebp - 0x139], al
mov eax, dword [ebp - 0x1ac]
add eax, ecx
mov ecx, eax
jmp 0x1c42fab
mov dword [ebp - 0x140], ecx
jmp 0x1c43268
lea eax, [ebp + 8]
mov ebx, dword [eax]
mov eax, ebx
mov ebx, dword [ebx + 0x48]
mov dword [ebp - 0x1ac], eax
mov edi, dword [eax + 0x4c]
cmp ebx, edi
je 0x1c43314
lea esi, [ebp - 0x12c]
jmp 0x1c432b3
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
add ebx, 0xc
cmp ebx, edi
je 0x1c43314
mov dword [ebp - 0x198], 0x61747461
mov dword [ebp - 0x190], 0xa00746e
mov dword [ebp - 0x194], 0x656d6863
mov ecx, esi
lea edx, [ebp - 0x198]
push ebx
call fcn.01c49b50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.01c70540
add esp, 8
cmp byte [ebp - 0x121], 0
jns 0x1c43309
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c432ac
jmp 0x1c4329e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1c43b19
mov edi, eax
xor eax, eax
lea esi, [ebp - 0x1a8]
push eax
push 0x1cf8c74
push eax
push 0x1cf8c68
push eax
push 0x1cf8c58
push edi
mov eax, dword [ebp - 0x1ac]
push dword [eax + 0x64]
push dword [0x1cf4d74]
push dword [0x1cf4d70]
push dword [0x1cf4d68]
push str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_llx_0x_llx_0x_llx
push esi
call fcn.01c7aae0
add esp, 0x34
push 0x18
call fcn.01c9515a
mov ecx, esi
add esp, 4
mov esi, eax
movsd xmm0, qword [0x1ce8ff9]
movsd qword [eax + 0xe], xmm0
movdqu xmm0, xmmword [str.__initial_client_data]
movdqu xmmword [eax], xmm0
mov byte [eax + 0x16], 0
movzx ebx, byte [ecx + 0xb]
test bl, bl
jns 0x1c433b5
mov ebx, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a8]
cmp ebx, 1
mov dword [ebp - 0x1b8], edi
ja 0x1c433f2
test ebx, ebx
je 0x1c433e3
lea eax, [esi + 0x16]
push ebx
push ecx
push eax
call fcn.01c994a0
add esp, 0xc
or ebx, 0x16
mov eax, esi
add eax, ebx
mov edi, 0x80000018
jmp 0x1c4347b
mov ebx, 0x16
mov edi, 0x80000018
jmp 0x1c4347e
mov dword [ebp - 0x1b0], ecx
lea eax, [ebx - 0x7fffffe1]
cmp eax, 0x8000001f
jbe 0x1c43e96
lea eax, [ebx + 0x16]
mov dword [ebp - 0x1b4], eax
cmp eax, 0x2f
mov edi, 0x2e
cmovae edi, eax
or edi, 7
inc edi
push edi
call fcn.01c9515a
add esp, 4
mov dword [ebp - 0x1c0], eax
movups xmm0, xmmword [str.__initial_client_data]
movups xmmword [eax], xmm0
movq xmm0, qword [0x1ce8ff9]
movq qword [eax + 0xe], xmm0
lea ecx, [eax + 0x16]
push ebx
push dword [ebp - 0x1b0]
push ecx
call fcn.01c994a0
add esp, 0xc
push esi
call fcn.01c95155
add esp, 4
or edi, 0x80000000
mov esi, dword [ebp - 0x1c0]
lea eax, [esi + ebx]
add eax, 0x16
mov ebx, dword [ebp - 0x1b4]
mov byte [eax], 0
lea ecx, [ebp - 0x198]
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edi
movzx eax, byte [ecx + 0xb]
test al, al
cmovs eax, ebx
cmovns esi, ecx
pxor xmm0, xmm0
lea edi, [ebp - 0x12c]
movq qword [edi], xmm0
mov dword [edi + 8], 0
push edi
push eax
push esi
call fcn.01c84f90
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push edi
call fcn.01c70540
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x1c434dc
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x18d], 0
jns 0x1c434f3
push dword [ebp - 0x198]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x19d], 0
jns 0x1c4350a
push dword [ebp - 0x1a8]
call fcn.01c95155
add esp, 4
pxor xmm0, xmm0
movdqu xmmword [ebp - 0x178], xmm0
xorps xmm1, xmm1
movsd qword [ebp - 0x158], xmm1
movdqu xmmword [ebp - 0x168], xmm0
movdqu xmmword [ebp - 0x188], xmm0
movdqu xmmword [ebp - 0x198], xmm0
mov dword [ebp - 0x16c], 0x100
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
mov dword [ebp - 0x160], eax
push 0xfffffffffffffff5
call esi
mov dword [ebp - 0x15c], eax
push 0xfffffffffffffff4
call esi
mov dword [ebp - 0x158], eax
xor eax, eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov eax, dword [0x1cf8c98]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c43de3
mov eax, dword [0x1cf8ca0]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c43e33
cmp dword [0x1cf8c94], 0
je 0x1c438e9
cmp dword [0x1cf8c9c], 0
je 0x1c438e9
lea edi, [ebp - 0x128]
xor eax, eax
push 0x118
push eax
push edi
call fcn.01c99a20
add esp, 0xc
mov dword [edi - 4], 0x11c
sub esp, 0x10
movdqa xmm0, xmmword [0x1cdf0a0]
movdqu xmmword [esp], xmm0
mov ebx, dword [sym.imp.ntdll.dll_VerSetConditionMask]
call ebx
mov esi, 3
push esi
push 1
push edx
push eax
call ebx
push esi
xor esi, esi
push 0x20
push edx
push eax
call ebx
mov dword [edi], 6
mov dword [edi + 4], esi
mov word [edi + 0x110], 0
push edx
push eax
push 0x23
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1c438e9
mov dword [ebp - 0x198], 0x48
lea edi, [ebp - 0x1a8]
mov dword [edi], 0xffffffff
mov ecx, dword [0x1cf8c94]
call dword [0x1cef298]
push edi
push esi
push 1
push esi
call ecx
test eax, eax
jne 0x1c43c71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1c43c2f
push dword [ebp - 0x1a8]
call fcn.01c96a5d
add esp, 4
mov esi, eax
mov dword [ebp - 0x154], eax
mov ecx, dword [0x1cf8c94]
call dword [0x1cef298]
push edi
push 0
push 1
mov dword [ebp - 0x1b0], esi
push esi
call ecx
test eax, eax
je 0x1c43d52
push 0x20
call fcn.01c9515a
add esp, 4
mov ebx, eax
add eax, 0x20
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], eax
mov eax, dword [0x1cf4d68]
mov dword [ebx], eax
mov eax, dword [0x1cf4d70]
mov dword [ebx + 4], eax
mov eax, dword [0x1cf4d74]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 0x64]
mov dword [ebx + 0xc], eax
lea esi, [ebx + 0x10]
mov eax, dword [ebp - 0x13c]
cmp esi, eax
jb 0x1c437d7
mov edi, dword [ebp - 0x144]
mov ecx, esi
sub ecx, edi
sar ecx, 2
mov dword [ebp - 0x1ac], ecx
inc ecx
cmp ecx, 0x40000000
jae 0x1c43ea6
sub eax, edi
mov edx, eax
sar edx, 1
cmp edx, ecx
cmovbe edx, ecx
cmp eax, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, edx
test ebx, ebx
je 0x1c43b12
cmp ebx, 0x40000000
jae 0x1c43efe
lea eax, [ebx*4]
push eax
call fcn.01c9515a
add esp, 4
mov ecx, dword [ebp - 0x1ac]
lea edx, [eax + ecx*4]
lea ebx, [eax + ebx*4]
mov dword [ebp - 0x1b4], ebx
lea ebx, [eax + ecx*4]
add ebx, 4
mov eax, dword [ebp - 0x1b8]
mov dword [edx], eax
cmp esi, edi
je 0x1c437b0
mov eax, dword [esi - 4]
add esi, 0xfffffffc
mov dword [edx - 4], eax
add edx, 0xfffffffc
cmp esi, edi
jne 0x1c4379a
mov esi, dword [ebp - 0x144]
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], eax
test esi, esi
je 0x1c437e3
push esi
call fcn.01c95155
add esp, 4
jmp 0x1c437e3
mov eax, dword [ebp - 0x1b8]
mov dword [ebx + 0x10], eax
add ebx, 0x14
lea edi, [ebp - 0x144]
mov dword [edi + 4], ebx
mov edx, dword [ebp - 0x160]
mov ecx, edi
call fcn.01c6bd90
mov edx, dword [ebp - 0x15c]
mov ecx, edi
call fcn.01c6bd90
mov edx, dword [ebp - 0x158]
mov ecx, edi
call fcn.01c6bd90
mov esi, dword [edi]
mov edi, dword [edi + 4]
sub edi, esi
je 0x1c43ea3
mov ecx, dword [0x1cf8c9c]
mov ebx, dword [ebp - 0x154]
call dword [0x1cef298]
xor eax, eax
push eax
push eax
push edi
push esi
push 0x20002
push eax
push ebx
call ecx
test eax, eax
je 0x1c43d99
lea eax, [ebp + 8]
mov edx, dword [eax]
mov esi, 0x80000
jmp 0x1c43905
mov edi, dword [edx + 4]
cmp edi, 0xc
jb 0x1c4391b
mov dword [ebp - 0x1b4], esi
mov esi, edx
test al, al
jns 0x1c43872
mov esi, dword [edx]
mov dword [ebp - 0x1ac], edx
push 0x20
call fcn.01c9515a
add esp, 4
mov ebx, eax
movq xmm0, qword [esi + edi*2 - 8]
movups xmm1, xmmword [esi + edi*2 - 0x18]
movups xmmword [eax], xmm1
movq qword [eax + 0x10], xmm0
mov word [eax + 0x18], 0
push str.rundll32.exe
push eax
call fcn.01c97111
add esp, 8
mov edi, eax
push ebx
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x12d], 0
jns 0x1c438cb
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1bc], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x1a8], xmm0
test edi, edi
mov esi, dword [ebp - 0x1b4]
je 0x1c43938
mov edx, dword [ebp - 0x1ac]
jmp 0x1c43948
mov dword [ebp - 0x198], 0x44
mov dword [ebp - 0x1b0], 0
xor esi, esi
mov edx, dword [ebp - 0x1ac]
movzx eax, byte [edx + 0xb]
test al, al
js 0x1c43858
mov edi, eax
cmp al, 0xc
jae 0x1c43864
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x1a8], xmm0
cmp byte [ebp - 0x12d], 0
js 0x1c4393c
lea eax, [ebp - 0x138]
jmp 0x1c43942
xor edx, edx
jmp 0x1c43950
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1bc], eax
cmp byte [edx + 0xb], 0
jns 0x1c43950
mov edx, dword [edx]
lea eax, [ebp - 0x1a8]
xor ecx, ecx
push eax
lea eax, [ebp - 0x198]
push eax
push ecx
push ecx
push esi
push 1
push ecx
push ecx
push dword [ebp - 0x1bc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1c43be6
push dword [ebp - 0x1a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1c43b62
push dword [ebp - 0x1a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1c43ba4
lea eax, [ebp + 8]
mov esi, dword [eax]
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
je 0x1c439c2
push eax
call fcn.01c39de0
add esp, 4
test al, al
je 0x1c43ea0
mov dword [esi + 0x64], 0xffffffff
pxor xmm0, xmm0
movdqu xmmword [ebp - 0x118], xmm0
movdqu xmmword [ebp - 0x128], xmm0
mov edi, 2
mov dword [ebp - 0x12c], edi
pxor xmm0, xmm0
lea eax, [ebp - 0x150]
movq qword [eax], xmm0
mov dword [eax + 8], 0
add esi, 0x54
push eax
lea eax, [ebp - 0x12c]
push eax
push esi
call fcn.01c39ba0
add esp, 0xc
mov ebx, eax
movzx eax, al
sub edi, eax
mov eax, dword [ebp - 0x1b0]
mov esi, eax
test eax, eax
je 0x1c43aa2
mov dword [ebp - 0x1b0], eax
mov eax, dword [0x1cf8ca8]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1c43a8e
push 0x1cf8ca8
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf8ca8], 0xffffffff
jne 0x1c43a8e
push str.kernel32.dll
call dword [sym.imp.progwrp.dll_LoadLibraryW]
test eax, eax
je 0x1c43e99
push 0x1ce64e8
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
mov dword [0x1cf8ca4], eax
push 0x1cf8ca8
call fcn.01c951d9
add esp, 4
mov ecx, dword [0x1cf8ca4]
call dword [0x1cef298]
push dword [ebp - 0x1b0]
call ecx
test esi, esi
je 0x1c43aaf
push esi
call fcn.01c968a6
add esp, 4
mov eax, dword [ebp - 0x144]
test eax, eax
je 0x1c43ac2
push eax
call fcn.01c95155
add esp, 4
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1c43ea9
cmp byte [ebp - 0x12d], 0
jns 0x1c43aed
push dword [ebp - 0x138]
call fcn.01c95155
add esp, 4
mov dword [0x1cf8c90], edi
lea ecx, [ebp + 8]
call fcn.01c6bc50
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x1bc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1c43776
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0x12c]
mov ecx, esi
push eax
push 2
push 0x1a7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0xb
push 0x1ce68b1
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, esi
call fcn.01c6d150
mov edi, 2
xor ebx, ebx
jmp 0x1c43ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x12c]
mov ecx, edi
push eax
push 1
push 0x228
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0x12
push str.CloseHandle_thread
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6d150
jmp 0x1c43990
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x12c]
mov ecx, edi
push eax
push 1
push 0x22b
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0x13
push str.CloseHandle_process
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6d150
jmp 0x1c439a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x12c]
mov ecx, edi
push eax
push 2
push 0x223
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0xd
push str.CreateProcess
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6d150
mov edi, 2
xor ebx, ebx
jmp 0x1c43a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0x12c]
mov ecx, esi
push eax
push 2
push 0x1dc
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0x28
push str.InitializeProcThreadAttributeList__size_
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, esi
call fcn.01c6d150
jmp 0x1c43d42
lea eax, [ebp - 0x124]
mov dword [eax - 8], 0x1cdea84
mov dword [eax - 4], 2
mov dword [eax], 0x1cdf0f0
lea esi, [ebp - 0xec]
lea edi, [ebp - 0x120]
mov dword [edi + 0x34], 0x1cdec1c
mov ecx, esi
push edi
call fcn.01c8db80
xor ebx, ebx
mov dword [edi + 0x7c], ebx
mov dword [esi + 0x4c], 0xffffffff
mov eax, dword [edi - 4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x124], 0x1cdeb38
mov ecx, edi
call fcn.01c7e730
mov dword [edi], 0x1cdebe0
pxor xmm0, xmm0
movdqu xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0x10
mov eax, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
mov dword [esi + 0x54], eax
mov edi, 0x1d8
mov dword [esi + 0x58], edi
call fcn.01c968ab
mov eax, dword [eax]
mov dword [esi + 0x5c], eax
call fcn.01c968ab
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x60], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [ebp - 0x12c]
mov ecx, esi
push edi
mov eax, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
push eax
call fcn.01c36e20
push 0x44
push str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
lea eax, [ebp - 0x124]
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, esi
call fcn.01c6c780
xor eax, eax
xor esi, esi
mov edi, 2
xor ebx, ebx
jmp 0x1c43a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x12c]
mov ecx, edi
push eax
push 2
push 0x1e7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0x21
push 0x1ce64c4
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6d150
xor eax, eax
mov esi, dword [ebp - 0x1b0]
jmp 0x1c43d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x12c]
mov ecx, edi
push eax
push 2
push 0x201
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0x124]
push 0x19
push 0x1ce7e44
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6d150
mov esi, dword [ebp - 0x1b0]
mov eax, esi
jmp 0x1c43d46
push 0x1cf8c98
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf8c98], 0xffffffff
jne 0x1c4359c
push str.kernel32.dll
call dword [sym.imp.progwrp.dll_LoadLibraryW]
test eax, eax
je 0x1c43f01
push 0x1ce64c4
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
mov dword [0x1cf8c94], eax
push 0x1cf8c98
call fcn.01c951d9
add esp, 4
jmp 0x1c4359c
push 0x1cf8ca0
call fcn.01c9518a
add esp, 4
cmp dword [0x1cf8ca0], 0xffffffff
jne 0x1c435bd
xor esi, esi
cmp dword [0x1cf8c94], 0
je 0x1c43e75
push str.kernel32.dll
call dword [sym.imp.progwrp.dll_LoadLibraryW]
test eax, eax
je 0x1c43e75
push 0x1ce7e44
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
mov esi, eax
mov dword [0x1cf8c9c], esi
push 0x1cf8ca0
call fcn.01c951d9
add esp, 4
jmp 0x1c435bd
int3
int3
int3
int3
xor eax, eax
jmp 0x1c43a7c
int3
int3
int3
push 0x1e
push str....._third_partycrashpadcrashpadutilwin_scoped_handle.cc
push 0x1ce8499
lea esi, [ebp - 0x12c]
push esi
call fcn.01c7f230
add esp, 0x10
push esi
push 0x1ce9569
lea esi, [ebp - 0x198]
push esi
call fcn.01c68a00
add esp, 0xc
mov eax, dword [ebp - 0x198]
add eax, 8
push 0xb
push 0x1ce83b0
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, esi
call fcn.01c30930
jmp 0x1c43ad6
int3
xor eax, eax
jmp 0x1c43e1c