Function at 0x10035da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6fe2
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x100d10d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push 0x100af930
mov dword [ebp - 0x1ec], esi
mov dword [ebp - 0x1e8], 0
call fcn.1000d740
add esp, 4
test edi, edi
je 0x10035e26
test esi, esi
je 0x10035e26
mov eax, 2
mov word [esi], ax
lea eax, [edi + 2]
push eax
call fcn.1004a880
mov esi, eax
add esp, 4
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 4], 0
test esi, esi
jne 0x10035e55
mov dword [ebp - 4], 0xffffffff
push 0x100afb2c
call fcn.1000d740
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061eb3
mov esp, ebp
pop ebp
ret 0xc
push 0
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x190], 0
push 0x100ad7c0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
call fcn.100166f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
push 4
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
push str.type
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
call fcn.100166f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x174]
push esi
push eax
call fcn.1004b8f0
add esp, 0x10
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x178]
cmp edx, 0x10
jb 0x10035f3b
mov ecx, dword [ebp - 0x18c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10035f31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370a2
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x190]
cmp edx, 0x10
jb 0x10035f94
mov ecx, dword [ebp - 0x1a4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10035f8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370a7
push edx
push ecx
call fcn.10061b42
add esp, 8
push 0
mov dword [ebp - 0x1c4], 0
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x1c0], 0
push 0x100ad7c0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
mov byte [ebp - 0x1d4], 0
call fcn.100166f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1bc]
push 7
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
push str.appname
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0xf
mov byte [ebp - 0x1bc], 0
call fcn.100166f0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x15c]
push esi
push eax
call fcn.1004b8f0
add esp, 0x10
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1a8]
cmp edx, 0x10
jb 0x10036095
mov ecx, dword [ebp - 0x1bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003608b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370ac
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0xf
mov byte [ebp - 0x1bc], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1c0]
cmp edx, 0x10
jb 0x100360ee
mov ecx, dword [ebp - 0x1d4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100360e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370b1
push edx
push ecx
call fcn.10061b42
add esp, 8
push 0
mov dword [ebp - 0x104], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x100], 0
push 0x100ad7c0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
mov byte [ebp - 0x1d4], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
call fcn.100166f0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x144]
push 7
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
push str.cmdline
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
call fcn.100166f0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.1004b8f0
add esp, 0x10
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x130]
cmp edx, 0x10
jb 0x100361ef
mov ecx, dword [ebp - 0x144]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100361e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370b6
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x100]
cmp edx, 0x10
jb 0x10036248
mov ecx, dword [ebp - 0x114]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003623e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370bb
push edx
push ecx
call fcn.10061b42
add esp, 8
movaps xmm0, xmmword [0x100b0300]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
movups xmmword [ebp - 0x210], xmm0
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x1fc], 0xffffffff
mov dword [ebp - 0x1f8], 0
mov byte [ebp - 4], 0x10
lea edi, [ebp - 0x174]
cmp dword [ebp - 0x160], 0x10
cmovae edi, dword [ebp - 0x174]
push edi
mov dword [ebp - 0x1d8], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push edi
push 0
push 0xfde9
mov dword [ebp - 0x1dc], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x204], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100d3c66
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10062033
mov edi, eax
add esp, 8
mov dword [ebp - 0x210], edi
test edi, edi
je 0x1003632a
push dword [ebp - 0x204]
push edi
push dword [ebp - 0x1dc]
push dword [ebp - 0x1d8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x204]
xor ecx, ecx
mov word [edi + eax*2], cx
movaps xmm0, xmmword [0x100b0300]
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x230], 0
mov byte [ebp - 4], 0x11
lea edi, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
cmovae edi, dword [ebp - 0x15c]
push edi
mov dword [ebp - 0x1d8], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push edi
push 0
push 0xfde9
mov dword [ebp - 0x1dc], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x23c], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100d3c66
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10062033
mov edi, eax
add esp, 8
mov dword [ebp - 0x248], edi
test edi, edi
je 0x100363f1
push dword [ebp - 0x23c]
push edi
push dword [ebp - 0x1dc]
push dword [ebp - 0x1d8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
mov word [edi + eax*2], cx
movaps xmm0, xmmword [0x100b0300]
movups xmmword [ebp - 0x22c], xmm0
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0x214], 0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
mov dword [ebp - 0x1d8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x220], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100d3c66
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10062033
add esp, 8
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x100364c1
push dword [ebp - 0x220]
push eax
push dword [ebp - 0x1dc]
push dword [ebp - 0x1d8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x22c]
xor edx, edx
mov ecx, dword [ebp - 0x220]
mov word [eax + ecx*2], dx
push str.createprocess
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10036703
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 0x1dd], al
lea eax, [ebp - 0x1f4]
push eax
call fcn.10042189
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1dd]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0x10024a40
push 0x100d345c
call fcn.10042e51
add esp, 0x10
test eax, eax
je 0x100366e7
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x1f4]
push eax
call fcn.100421c3
mov ecx, dword [0x100d3458]
add esp, 4
push edi
call fcn.10018610
test eax, eax
je 0x1003657a
lea eax, [ebp - 0x1d8]
push eax
push dword [ebp - 0x22c]
push edi
call fcn.10027180
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
call fcn.1004a630
mov dword [ebp - 0x1d8], eax
mov byte [ebp - 4], 0x15
test eax, eax
jne 0x10036596
mov byte [ebp - 4], 0x12
jmp 0x1003662b
cmp dword [ebp - 0x1e8], 0
je 0x100365a6
call fcn.1004a6e0
jmp 0x100365ab
call fcn.1004a5a0
push eax
push str.result
push dword [ebp - 0x1d8]
call fcn.1004a520
mov eax, dword [ebp - 0x1dc]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b02e0]
movsd qword [esp], xmm0
call fcn.1004a5d0
push eax
push str.processid
push dword [ebp - 0x1d8]
call fcn.1004a520
push dword [ebp - 0x1d8]
call fcn.1004a8e0
add esp, 0x18
mov dword [ebp - 0x1dc], eax
test eax, eax
jne 0x1003668a
mov byte [ebp - 4], 0x12
push dword [ebp - 0x1d8]
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1d8], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x22c]
call fcn.1002f8b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x248]
call fcn.1002f8b0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x210]
call fcn.1002f8b0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x12c]
call fcn.1000b880
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x15c]
call fcn.1000b880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.1000b880
jmp 0x10037071
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [eax + 1]
cmp edx, 0x1ffe
ja 0x100366bb
mov ecx, dword [ebp - 0x1ec]
lea eax, [edx + 2]
push edx
push dword [ebp - 0x1dc]
mov word [ecx], ax
lea eax, [ecx + 2]
push eax
call fcn.1006dee0
add esp, 0xc
push dword [ebp - 0x1dc]
call fcn.1007460b
mov byte [ebp - 4], 0x12
push dword [ebp - 0x1d8]
call fcn.1004a710
add esp, 8
mov dword [ebp - 0x1d8], 0
jmp 0x10036aa3
lea eax, [ebp - 0x1f4]
push eax
call fcn.100421e4
add esp, 4
test al, al
je 0x100370e4
jmp 0x100370c0
push str.CreateProcessAsSystem
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10036c63
push 0x40
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
push eax
call fcn.1006e460
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x13c], xmm0
test edi, edi
je 0x10036baf
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x10036baf
mov byte [ebp - 0x1dd], al
lea eax, [ebp - 0x1f4]
push eax
call fcn.10042189
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1dd]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0x10024a40
push 0x100d345c
call fcn.10042e51
add esp, 0x10
test eax, eax
je 0x10036b93
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x1f4]
push eax
call fcn.100421c3
mov ecx, dword [0x100d3458]
add esp, 4
push edi
call fcn.10018610
test eax, eax
jne 0x10036835
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x22c]
call fcn.1002f8b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x248]
call fcn.1002f8b0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x210]
call fcn.1002f8b0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x12c]
call fcn.1000b880
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x15c]
call fcn.1000b880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.1000b880
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1e4], 0
jmp 0x10035e26
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1dc], eax
test eax, eax
je 0x10036873
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x1dc]
mov dword [ebp - 0x104], eax
call esi
mov dword [ebp - 0x100], eax
jmp 0x10036879
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x104]
test ecx, ecx
je 0x10036890
test eax, eax
je 0x10036890
lea eax, [ebp - 0x108]
push eax
call ecx
mov byte [ebp - 4], 0x18
push dword [ebp - 0x22c]
call fcn.100764f9
add esp, 4
mov esi, eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov dword [ebp - 0x1e8], eax
call fcn.1007460b
add esp, 4
cmp dword [ebp - 0x1e8], 0
je 0x100368f1
push dword [ebp - 0x138]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x13c]
call esi
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1dc], eax
call fcn.1004a630
mov esi, eax
mov dword [ebp - 0x1d8], esi
mov byte [ebp - 4], 0x19
test esi, esi
jne 0x1003691b
mov byte [ebp - 4], 0x18
jmp 0x100369a0
cmp dword [ebp - 0x1e8], 0
je 0x1003692b
call fcn.1004a6e0
jmp 0x10036930
call fcn.1004a5a0
push eax
push str.result
push esi
call fcn.1004a520
mov eax, dword [ebp - 0x1dc]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b02e0]
movsd qword [esp], xmm0
call fcn.1004a5d0
push eax
push str.processid
push esi
call fcn.1004a520
push esi
call fcn.1004a8e0
add esp, 0x18
mov dword [ebp - 0x1dc], eax
test eax, eax
jne 0x10036a2b
mov byte [ebp - 4], 0x18
push esi
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1d8], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x104], 0
je 0x100369bf
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x100369bf
push dword [ebp - 0x108]
call eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x22c]
call fcn.1002f8b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x248]
call fcn.1002f8b0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x210]
call fcn.1002f8b0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x12c]
call fcn.1000b880
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x15c]
call fcn.1000b880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.1000b880
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1e4]
jmp 0x10037079
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [eax + 1]
cmp edx, 0x1ffe
ja 0x10036a5c
mov eax, dword [ebp - 0x1ec]
lea ecx, [edx + 2]
push edx
push dword [ebp - 0x1dc]
mov word [eax], cx
add eax, 2
push eax
call fcn.1006dee0
add esp, 0xc
push dword [ebp - 0x1dc]
call fcn.1007460b
mov byte [ebp - 4], 0x18
push esi
call fcn.1004a710
add esp, 8
mov dword [ebp - 0x1d8], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x104], 0
je 0x10036a9d
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x10036a9d
push dword [ebp - 0x108]
call eax
mov esi, dword [ebp - 0x1e4]
mov byte [ebp - 4], 0x11
push dword [ebp - 0x22c]
call fcn.10061fde
push 0
mov dword [ebp - 0x22c], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x228], 0
call fcn.10061fde
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.10061fde
push 0
mov dword [ebp - 0x248], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x244], 0
call fcn.10061fde
mov dword [ebp - 0x240], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x210]
call fcn.10061fde
push 0
mov dword [ebp - 0x210], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x20c], 0
call fcn.10061fde
add esp, 0x24
mov dword [ebp - 0x208], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x10036fa4
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036f9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100370e9
jmp 0x10036f9a
lea eax, [ebp - 0x1f4]
push eax
call fcn.100421e4
add esp, 4
test al, al
jne 0x100370ee
jmp 0x100370e4
mov byte [ebp - 4], 0x11
push dword [ebp - 0x22c]
call fcn.10061fde
push 0
mov dword [ebp - 0x22c], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x228], 0
call fcn.10061fde
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.10061fde
push 0
mov dword [ebp - 0x248], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x244], 0
call fcn.10061fde
mov dword [ebp - 0x240], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x210]
call fcn.10061fde
push 0
mov dword [ebp - 0x210], 0
call fcn.10061fde
push 0
mov dword [ebp - 0x20c], 0
call fcn.10061fde
add esp, 0x24
mov dword [ebp - 0x208], 0
jmp 0x100367e9
push str.SetImmersiveControlPanelAppid
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10036e9a
movups xmm0, xmmword [str.microsoft.windows.immersivecontrolpanel]
mov ecx, 0x24
lea edi, [ebp - 0xfc]
mov esi, str.windows.immersivecontrolpanel_10.0.1.1000_neutral_neutral_cw5n1h2txyewy
movups xmmword [ebp - 0x6c], xmm0
push 0xa
movups xmm0, xmmword [0x100afa00]
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x248]
movups xmmword [ebp - 0x5c], xmm0
push edi
movups xmm0, xmmword [0x100afa10]
movups xmmword [ebp - 0x4c], xmm0
movups xmm0, xmmword [0x100afa20]
movups xmmword [ebp - 0x3c], xmm0
movups xmm0, xmmword [0x100afa30]
movups xmmword [ebp - 0x2c], xmm0
call fcn.1007646e
add esp, 0xc
test eax, eax
jne 0x10036d59
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x22c]
call fcn.1002f8b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x248]
call fcn.1002f8b0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x210]
call fcn.1002f8b0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x12c]
call fcn.1000b880
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x15c]
call fcn.1000b880
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.1000b880
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1e4]
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1e4], 0
jmp 0x10035e26
xor ecx, ecx
mov dword [ebp - 0x1c], 0x330051
mov word [ebp - 0x14], cx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 0x300036
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push eax
call fcn.1002ca70
xor ecx, ecx
add esp, 0x10
test eax, eax
setns cl
mov dword [ebp - 0x1e8], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1dc], eax
call fcn.1004a630
mov esi, eax
mov dword [ebp - 0x1d8], esi
mov byte [ebp - 4], 0x1a
test esi, esi
jne 0x10036dbc
mov byte [ebp - 4], 0x12
jmp 0x100369bf
cmp dword [ebp - 0x1e8], 0
je 0x10036dcc
call fcn.1004a6e0
jmp 0x10036dd1
call fcn.1004a5a0
push eax
push str.result
push esi
call fcn.1004a520
mov eax, dword [ebp - 0x1dc]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b02e0]
movsd qword [esp], xmm0
call fcn.1004a5d0
push eax
push str.processid
push esi
call fcn.1004a520
push esi
call fcn.1004a8e0
add esp, 0x18
mov dword [ebp - 0x1dc], eax
test eax, eax
jne 0x10036e42
mov byte [ebp - 4], 0x12
push esi
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1d8], 0
jmp 0x100369bf
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [eax + 1]
cmp edx, 0x1ffe
ja 0x10036e73
mov eax, dword [ebp - 0x1ec]
lea ecx, [edx + 2]
push edx
push dword [ebp - 0x1dc]
mov word [eax], cx
add eax, 2
push eax
call fcn.1006dee0
add esp, 0xc
push dword [ebp - 0x1dc]
call fcn.1007460b
mov byte [ebp - 4], 0x12
push esi
call fcn.1004a710
add esp, 8
mov dword [ebp - 0x1d8], 0
jmp 0x10036a9d
push str.LoadLibraryEx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10036aa3
push edi
mov dword [ebp - 0x1d8], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x10036f6e
push edi
call fcn.10032db0
add esp, 4
test eax, eax
je 0x10036f6e
lea ecx, [ebp - 0x108]
call fcn.1002f5c0
mov byte [ebp - 4], 0x1b
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1d8], eax
test eax, eax
je 0x10036f4f
cmp dword [ebp - 0x11c], 0
jne 0x10036f18
push 0x17
push str.LoadLibraryExThreadProc
lea ecx, [ebp - 0x12c]
call fcn.100166f0
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
push dword [ebp - 0x1d8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10036f4f
push dword [ebp - 0x1ec]
call eax
mov dword [ebp - 0x1e8], 1
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x104], 0
je 0x10036f6e
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x10036f6e
push dword [ebp - 0x108]
call eax
push dword [ebp - 0x1d8]
push str.ModuleHandle
push dword [ebp - 0x1ec]
push dword [ebp - 0x1e8]
call fcn.10035000
add esp, 0x10
test eax, eax
jne 0x10036aa3
jmp 0x1003662b
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x148]
cmp edx, 0x10
jb 0x10036ffd
mov ecx, dword [ebp - 0x15c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036ff3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037112
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x160]
cmp edx, 0x10
jb 0x10037056
mov ecx, dword [ebp - 0x174]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003704c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037117
push edx
push ecx
call fcn.10061b42
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.1004a710
add esp, 4
mov dword [ebp - 0x1e4], 0
cmp dword [ebp - 0x1e8], 0
je 0x10035e26
push 0x100afb14
jmp 0x10035e2b
call fcn.10071549
call fcn.10071549
call fcn.10071549
call fcn.10071549
call fcn.10071549
call fcn.10071549
sub esp, 8
lea eax, [ebp - 0x1f4]
mov ecx, esp
mov dword [ebp - 0x1dc], esp
push eax
call fcn.1000afd0
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x13
call fcn.10017ed0
call fcn.10042e69
call fcn.10071549
sub esp, 8
lea eax, [ebp - 0x1f4]
mov ecx, esp
mov dword [ebp - 0x1dc], esp
push eax
call fcn.1000afd0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.10017ed0
call fcn.10071549
call fcn.10071549
int3