Function at 0x10033920
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007024c
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x100871e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x63c], 0x1000
push 0x5105
mov ecx, dword [0x1008954c]
call fcn.1002aa70
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jne 0x10033997
or eax, 0xffffffff
jmp 0x10033d72
push 0x514d
mov ecx, dword [0x1008954c]
call fcn.1002aa70
push eax
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x100339db
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xfffffffe
jmp 0x10033d72
cmp dword [ebp - 0x63c], 0x80000
jae 0x10033a7b
mov edx, dword [ebp - 0x63c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x10033a15
mov dword [ebp - 0x634], 0xfffffffd
jmp 0x10033a7b
lea eax, [ebp - 0x654]
push eax
mov ecx, dword [ebp - 0x63c]
push ecx
mov edx, dword [ebp - 0x638]
push edx
push 5
call dword [ebp - 0x644]
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jne 0x10033a43
jmp 0x10033a7b
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x634], 0xc0000004
je 0x10033a68
mov dword [ebp - 0x634], 0xfffffffc
jmp 0x10033a7b
mov ecx, dword [ebp - 0x63c]
shl ecx, 1
mov dword [ebp - 0x63c], ecx
jmp 0x100339db
mov edx, dword [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x634], 0
je 0x10033a9c
mov eax, dword [ebp - 0x634]
jmp 0x10033d72
push 0x5153
mov ecx, dword [0x1008954c]
call fcn.1002aa70
mov dword [ebp - 0x648], eax
mov eax, dword [0x10089618]
and eax, 1
jne 0x10033ae9
mov ecx, dword [0x10089618]
or ecx, 1
mov dword [0x10089618], ecx
mov edx, dword [ebp - 0x648]
push edx
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008961c], eax
cmp dword [0x1008961c], 0
jne 0x10033b1c
mov eax, dword [ebp - 0x648]
push eax
push 0x2144
mov ecx, dword [0x1008954c]
call fcn.1002ab40
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008961c], eax
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x1008961c]
mov edx, dword [0x10089618]
and edx, 2
jne 0x10033b83
mov eax, dword [0x10089618]
or eax, 2
mov dword [0x10089618], eax
mov dword [ebp - 4], 0
push 0x1007cd30
push 0x2144
mov ecx, dword [0x1008954c]
call fcn.1002ab40
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10089620], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10089618]
and ecx, 4
jne 0x10033bd3
mov edx, dword [0x10089618]
or edx, 4
mov dword [0x10089618], edx
mov dword [ebp - 4], 1
push str.IsImmersiveProcess
push 0x54ad
mov ecx, dword [0x1008954c]
call fcn.1002ab40
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10089624], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x62c], eax
mov ecx, 1
test ecx, ecx
je 0x10033d3a
mov edx, dword [ebp - 0x62c]
cmp dword [edx + 0x3c], 0
je 0x10033d14
push 0x104
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax + 0x3c]
push ecx
lea edx, [ebp - 0x628]
push edx
call fcn.100452e1
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.1004532b
add esp, 8
test eax, eax
jne 0x10033d14
mov dword [ebp - 0x64c], 1
cmp dword [ebp + 0xc], 1
jne 0x10033d12
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0x44]
push eax
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x10033cfa
push 0
push 2
push 6
call fcn.10019100
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x10033ca2
cmp dword [0x10089624], 0
je 0x10033ca2
mov edx, dword [ebp - 0x630]
push edx
call dword [0x10089624]
test eax, eax
jne 0x10033cfa
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x630]
push ecx
call dword [0x1008961c]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.1004532b
add esp, 8
test eax, eax
je 0x10033cf2
push 0
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10033cf2
mov dword [ebp - 0x650], 1
push 0x32
call dword [0x10089620]
cmp dword [ebp - 0x630], 0
je 0x10033d10
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10033d14
jmp 0x10033d3a
mov eax, dword [ebp - 0x62c]
cmp dword [eax], 0
jne 0x10033d21
jmp 0x10033d3a
mov ecx, dword [ebp - 0x62c]
mov edx, dword [ebp - 0x62c]
add edx, dword [ecx]
mov dword [ebp - 0x62c], edx
jmp 0x10033bdf
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x64c], 0
jne 0x10033d57
mov eax, 0xfffffffb
jmp 0x10033d72
cmp dword [ebp + 0xc], 1
jne 0x10033d6d
cmp dword [ebp - 0x650], 0
jne 0x10033d6d
mov eax, 0xfffffffa
jmp 0x10033d72
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100422b3
mov esp, ebp
pop ebp
ret