Function at 0xffc35d1
Capabilities:
Access peb ldr_data
Check processdebugport

Disassembly:
push 0xd9c
push 0xffb1ec0
call fcn.0ffe120c
mov eax, dword [0xffebc20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd4c], eax
xor ebx, ebx
cmp dword [0xffed364], ebx
jne 0xffc362a
mov dword [ebp - 0xd3c], ebx
push ebx
push 4
lea eax, [ebp - 0xd3c]
push eax
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, ebx
jl 0xffc362a
cmp dword [ebp - 0xd3c], ebx
jne 0xffc39b5
cmp dword [ebp + 8], 0xc0000008
je 0xffc39ce
cmp dword [ebp + 8], 0xc0000235
je 0xffc39ce
mov dword [ebp - 0xd44], ebx
mov dword [ebp - 0xd48], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x1c]
mov eax, dword fs:[0x18]
mov ecx, dword [ecx + 0xc]
cmp ecx, dword [eax + 0x24]
je 0xffc36f4
mov dword [ebp - 4], ebx
push 0xff
lea eax, [ebp - 0x238]
push eax
push ebx
push 0xffb1eb0
mov edi, 0xffb1ea8
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
call esi
test eax, eax
je 0xffc36d3
mov dword [ebp - 0xd44], 2
push 7
lea eax, [ebp - 0x30]
push eax
push 0xffb1ea4
push 0xffb1e9c
push edi
call esi
test eax, eax
je 0xffc36d3
push 0xffb1e98
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0xffc36d3
mov dword [ebp - 0xd48], 1
or dword [ebp - 4], 0xffffffff
jmp 0xffc36f4
cmp dword [ebp - 0xd48], ebx
je 0xffc371f
push 8
push str.drwtsn32
lea eax, [ebp - 0x238]
push eax
call fcn.0ffc3540
test eax, eax
jne 0xffc371f
mov dword [ebp - 0xd44], ebx
mov dword [ebp - 0xd48], ebx
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0xc0]
mov ecx, dword [ebx]
call fcn.0ffb37a5
movzx ecx, word [ebx + 0x4c]
shl ecx, 0x10
call fcn.0ffb37a5
mov ecx, eax
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ecx + 0xf2]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0xf6]
mov dword [ebp - 0x24], eax
mov eax, dword [0xffed2c4]
lea ecx, [ebp - 0x138]
sub ecx, eax
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0xffc3767
lea eax, [ebp - 0xd40]
push eax
mov esi, dword [ebp - 0xd4c]
mov eax, dword [esi]
push dword [eax + 0xc]
call dword [sym.imp.ntdll.dll_RtlPcToFileHeader]
push 0x105
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0xd40]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea eax, [ebp - 0x138]
push eax
call fcn.0ffc33ad
test eax, eax
je 0xffc37b6
inc eax
jmp 0xffc37bc
lea eax, [ebp - 0x138]
mov edi, dword [ebp + 8]
cmp edi, 0xc0000093
ja 0xffc3817
cmp edi, 0xc000008d
jae 0xffc380f
cmp edi, 0x80000002
je 0xffc3807
cmp edi, 0xc0000005
je 0xffc37ff
cmp edi, 0xc0000006
je 0xffc37f7
cmp edi, 0xc000001d
jne 0xffc382f
mov ecx, dword [0xffed2e4]
jmp 0xffc3845
mov ecx, dword [0xffed2e8]
jmp 0xffc3845
mov ecx, dword [0xffed2d8]
jmp 0xffc3845
mov ecx, dword [0xffed2e0]
jmp 0xffc3845
mov ecx, dword [0xffed2f0]
jmp 0xffc3845
cmp edi, 0xc0000094
je 0xffc383f
cmp edi, 0xc0000096
je 0xffc37ef
cmp edi, 0xc00000fd
je 0xffc3837
mov ecx, dword [0xffed2d4]
jmp 0xffc3845
mov ecx, dword [0xffed2dc]
jmp 0xffc3845
mov ecx, dword [0xffed2ec]
push edi
mov edx, dword [esi]
push dword [edx + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
lea eax, [ebp - 0x738]
push eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
call esi
add esp, 0x18
cmp dword [ebp - 0xd48], 0
je 0xffc3874
push 2
pop eax
jmp 0xffc3902
mov eax, dword [0xffed2f4]
cmp word [ebp - 0xd44], 2
jne 0xffc38b7
cmp edi, 0x80000002
je 0xffc3890
mov eax, dword [0xffed2d0]
push eax
push dword [0xffed2cc]
push dword [0xffed2c8]
lea eax, [ebp - 0x738]
push eax
push 0xffb1e88
lea eax, [ebp - 0xc38]
push eax
call esi
add esp, 0x18
jmp 0xffc38e3
cmp edi, 0x80000002
je 0xffc38c4
mov eax, dword [0xffed2d0]
push eax
push dword [0xffed2c8]
lea eax, [ebp - 0x738]
push eax
push 0xffb1e7c
lea eax, [ebp - 0xc38]
push eax
call esi
add esp, 0x14
push 0x8007
push dword [ebp - 0xd44]
push 8
lea eax, [ebp - 0xc38]
push eax
push dword [0xffed2c0]
call sub.ntvdm.exe_WOWSysErrorBox
cmp eax, 2
jne 0xffc39b9
mov dword [ebp - 0xd58], 0xc
xor ecx, ecx
mov dword [ebp - 0xd54], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xd50], eax
push ecx
push ecx
push eax
lea eax, [ebp - 0xd58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0xdac]
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
mov dword [ebp - 0xdac], 0x44
mov dword [ebp - 0xda4], 0xffb1e6c
call dword [sym.imp.ntdll.dll_CsrIdentifyAlertableThread]
lea eax, [ebp - 0xd68]
push eax
lea eax, [ebp - 0xdac]
push eax
xor edi, edi
push edi
push edi
push edi
push 1
push edi
push edi
lea eax, [ebp - 0xd38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0xffc39e1
cmp esi, edi
je 0xffc39e1
push edi
push 1
push esi
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
xor eax, eax
jmp 0xffc39d1
cmp eax, 3
jne 0xffc39e1
cmp edi, 0x80000002
jne 0xffc39ee
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 0xffffffff
mov ecx, dword [ebp - 0x1c]
call fcn.0ffe11f0
call fcn.0ffe1247
ret 8
mov ecx, dword [ebx]
call fcn.0ffb37a5
mov word [eax + 2], 0x1e
xor eax, eax
inc eax
jmp 0xffc39d1