Function at 0x1000dbaf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x178
mov esi, esp
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [esi + 0x170], eax
lea eax, [ebp + 8]
mov dword [esi + 8], eax
lea eax, [ebp + 0x20]
mov dword [esi + 4], eax
lea ecx, [esi + 0x158]
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov eax, 0xf
mov dword [ecx + 0x14], eax
mov byte [ecx], bl
lea edx, [esi + 0x140]
mov dword [esi + 0x14], edx
mov ecx, dword [esi + 0x14]
mov dword [edx], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], eax
mov byte [edx], bl
lea edx, [esi + 0x128]
mov dword [esi + 0x18], edx
mov ecx, dword [esi + 0x18]
mov dword [edx], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], eax
mov byte [edx], bl
lea edx, [esi + 0x110]
mov dword [esi + 0x1c], edx
mov ecx, dword [esi + 0x1c]
mov dword [edx], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], eax
mov byte [edx], bl
lea edx, [esi + 0xf8]
mov dword [esi + 0x20], edx
mov ecx, dword [esi + 0x20]
mov dword [edx], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], 7
mov word [edx], 0
lea edx, [esi + 0xe0]
mov dword [esi + 0x24], edx
mov ecx, dword [esi + 0x24]
mov dword [edx], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], eax
mov byte [edx], bl
lea ecx, [esi + 0xc8]
mov dword [esi + 0x28], ecx
mov edx, dword [esi + 0x28]
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], eax
mov byte [ecx], bl
lea edi, [esi + 0xa8]
mov dword [esi + 0x2c], edi
mov eax, dword [esi + 0x2c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov ecx, edi
push 1
call fcn.1000e936
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
lea eax, [esi + 0xa4]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x30]
lea eax, [esi + 0x98]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
lea eax, [esi + 0x90]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x38]
lea eax, [esi + 0x88]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x3c]
lea eax, [esi + 0x80]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x40]
lea eax, [esi + 0x78]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x44]
lea eax, [esi + 0x70]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x48]
lea eax, [esi + 0x6c]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x4c]
lea eax, [esi + 0x68]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x50]
lea ecx, [esi + 0x64]
mov dword [esi + 0x54], ecx
mov eax, dword [esi + 0x54]
mov dword [ecx], ebx
lea eax, [esi + 0x60]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 4]
push eax
push dword [ecx]
call fcn.10012267
add esp, 8
call fcn.10062a8e
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
add ecx, 0x10
push eax
push ecx
call fcn.10012267
add esp, 8
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
add ecx, 0x28
push eax
push ecx
call fcn.10012267
add esp, 8
mov eax, 0x6f71d37d
cmp eax, 0xd3f15ddf
jle 0x1000ddc0
cmp eax, 0x42820a2a
jg 0x1000de55
cmp eax, 0x1fc10317
jle 0x1000df8c
cmp eax, 0x1fc10318
je 0x1000e15b
cmp eax, 0x240ea345
je 0x1000e1d8
cmp eax, 0x281d7b9a
jne 0x1000dd67
lea eax, [esi + 0xa8]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x5c]
cmp dword [eax + 4], 0
mov eax, 0x42820a2b
mov ecx, 0x52510ae
cmove eax, ecx
jmp 0x1000dd67
cmp eax, 0x992e42e6
jg 0x1000dea4
cmp eax, 0x9710b1e9
jle 0x1000e017
cmp eax, 0x9710b1ea
je 0x1000e219
cmp eax, 0x987ffd1e
je 0x1000e236
cmp eax, 0x992b99a5
jne 0x1000dd67
call fcn.1006982c
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
add ecx, 0x48
push eax
push ecx
call fcn.10012267
add esp, 8
lea eax, [esi + 0x70]
push eax
lea eax, [esi + 0x78]
push eax
lea eax, [esi + 0x80]
push eax
lea eax, [esi + 0x88]
push eax
lea eax, [esi + 0x90]
push eax
lea eax, [esi + 0x98]
push eax
lea eax, [esi + 0xa4]
push eax
call fcn.100665c1
add esp, 0x1c
test al, al
mov eax, 0xcf9e2702
mov ecx, 0x987ffd1e
cmovne eax, ecx
jmp 0x1000dd67
cmp eax, 0x6f71d37c
jle 0x1000e06f
cmp eax, 0x75dbd8e1
je 0x1000e2f9
cmp eax, 0x73a6e7c1
je 0x1000e31e
cmp eax, 0x6f71d37d
jne 0x1000dd67
lea eax, [esi + 0x158]
push eax
call fcn.10066727
add esp, 4
test al, al
mov eax, 0xb93e8e64
mov ecx, 0x1fc10318
cmovne eax, ecx
jmp 0x1000dd67
cmp eax, 0xb93e8e63
jle 0x1000e0c5
cmp eax, 0xb93e8e64
je 0x1000e358
cmp eax, 0xcf9e2702
je 0x1000e382
cmp eax, 0xd2d93675
jne 0x1000dd67
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xd8
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
lea eax, [esi + 0x64]
push eax
call fcn.10067be4
add esp, 4
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0xe0
add eax, ecx
push dword [esi + 0x64]
push eax
call fcn.10012267
add esp, 8
mov edi, esp
sub esp, 0x1c
mov ebx, esp
lea eax, [ebx + 4]
push eax
call fcn.1007f904
add esp, 4
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0xf8
add eax, ecx
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov esp, edi
mov edi, esp
push eax
sub esp, 0x18
mov ebx, esp
lea eax, [ebx + 4]
push eax
call fcn.1007fccf
add esp, 4
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0x100
add eax, ecx
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov esp, edi
push 0x71
lea eax, [esi + 0xa8]
push eax
call fcn.10071088
add esp, 8
test eax, eax
mov eax, 0x52510ae
mov ecx, 0x281d7b9a
cmove eax, ecx
jmp 0x1000dd67
cmp eax, 0xd3f15de0
je 0x1000e3c1
cmp eax, 0xe65ec8e9
jne 0x1000e568
mov dword [esi + 0xc], esp
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 4]
xor edi, edi
mov dword [ebx + 4], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
lea eax, [esi + 0x140]
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x18
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov esp, dword [esi + 0xc]
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 4]
mov dword [ebx + 4], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
lea eax, [esi + 0x128]
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x20
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov eax, 0x240ea345
mov esp, dword [esi + 0xc]
jmp 0x1000dd67
cmp eax, 0x83eec1c6
je 0x1000e478
cmp eax, 0x84861520
jne 0x1000dd67
mov edi, esp
push eax
sub esp, 0x14
mov ecx, esp
mov eax, dword [esi + 8]
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
push eax
call fcn.10007eb6
call fcn.1000c65a
add esp, 0x18
mov esp, edi
mov ecx, eax
push 2
call fcn.1000c58a
test al, al
mov eax, 0xd2d93675
mov ecx, 0x75dbd8e1
cmovne eax, ecx
jmp 0x1000dd67
cmp eax, 0x42820a2b
je 0x1000e4ca
cmp eax, 0x6ea489eb
jne 0x1000dd67
mov edi, esp
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 4]
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
lea eax, [esi + 0x110]
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x30
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov eax, 0xb93e8e64
mov esp, edi
jmp 0x1000dd67
cmp eax, 0x992e42e7
je 0x1000e512
cmp eax, 0xaf89d3ae
jne 0x1000dd67
lea eax, [esi + 0x60]
push eax
call fcn.100145e4
add esp, 4
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xc0
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0xc8
add eax, ecx
push dword [esi + 0x60]
push eax
call fcn.10012267
add esp, 8
call fcn.100146f4
movzx eax, al
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xe8
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
call fcn.1001953a
movzx eax, al
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xf0
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
mov eax, 0x84861520
jmp 0x1000dd67
mov edi, esp
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 4]
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
lea eax, [esi + 0x158]
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 8
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov esp, edi
mov ebx, esp
push eax
sub esp, 0x18
mov edi, esp
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ecx, edi
lea eax, [esi + 0x158]
push eax
call fcn.10007eb6
lea eax, [esi + 0x110]
mov dword [edi + 0x18], eax
call fcn.10066bc3
add esp, 0x1c
mov esp, ebx
test eax, eax
mov eax, 0x6ea489eb
mov ecx, 0xb93e8e64
cmove eax, ecx
jmp 0x1000dd67
mov edi, esp
push eax
sub esp, 0x14
mov ecx, esp
mov eax, dword [esi + 8]
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
push eax
call fcn.10007eb6
call fcn.1000c65a
add esp, 0x18
mov esp, edi
mov ecx, eax
push ebx
call fcn.1000c58a
test al, al
mov eax, 0x992b99a5
mov ecx, 0x992e42e7
cmovne eax, ecx
jmp 0x1000dd67
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x38
push 0
push eax
call fcn.10012267
add esp, 8
mov eax, 0x992b99a5
jmp 0x1000dd67
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x50
push dword [esi + 0xa4]
push eax
call fcn.10012267
add esp, 8
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x58
push dword [esi + 0x9c]
push dword [esi + 0x98]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x60
push dword [esi + 0x94]
push dword [esi + 0x90]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x68
push dword [esi + 0x8c]
push dword [esi + 0x88]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x70
push dword [esi + 0x84]
push dword [esi + 0x80]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x78
push dword [esi + 0x7c]
push dword [esi + 0x78]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, dword [esi + 4]
mov eax, dword [eax]
sub eax, 0xffffff80
push dword [esi + 0x74]
push dword [esi + 0x70]
push eax
call fcn.1001236c
add esp, 0xc
mov eax, 0xcf9e2702
jmp 0x1000dd67
call fcn.1001a836
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xd0
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
mov eax, 0xd2d93675
jmp 0x1000dd67
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0x90
add eax, ecx
push dword [esi + 0x6c]
push eax
call fcn.10012267
add esp, 8
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0x98
add eax, ecx
push dword [esi + 0x68]
push eax
call fcn.10012267
add esp, 8
mov eax, 0xd3f15de0
jmp 0x1000dd67
lea eax, [esi + 0x128]
push eax
lea eax, [esi + 0x140]
push eax
call fcn.10062b42
add esp, 8
test al, al
mov eax, 0x240ea345
mov ecx, 0xe65ec8e9
cmovne eax, ecx
jmp 0x1000dd67
call fcn.1006a19e
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0x88
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
lea eax, [esi + 0x68]
push eax
lea eax, [esi + 0x6c]
push eax
call fcn.1000a9e4
add esp, 8
test al, al
mov eax, 0xd3f15de0
mov ecx, 0x73a6e7c1
cmovne eax, ecx
jmp 0x1000dd67
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xa0
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
push ebx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xa8
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
xor eax, eax
inc eax
push eax
call edi
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edx, 0xb0
add ecx, edx
push eax
push ecx
call fcn.10012267
add esp, 8
call fcn.1005c79a
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
mov edi, 0xb8
add ecx, edi
push edx
push eax
push ecx
call fcn.1001236c
add esp, 0xc
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov eax, dword [esi + 8]
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
push eax
call fcn.10007eb6
call fcn.1000c65a
add esp, 0x18
mov esp, edi
mov ecx, eax
xor eax, eax
inc eax
push eax
call fcn.1000c58a
test al, al
mov eax, 0x84861520
mov ecx, 0xaf89d3ae
cmovne eax, ecx
jmp 0x1000dd67
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x38
push 1
push eax
call fcn.10012267
add esp, 8
mov edi, esp
sub esp, 0x1c
mov ebx, esp
lea ecx, [ebx + 4]
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
lea eax, [esi + 0xe0]
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
add eax, 0x40
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov eax, 0x992b99a5
mov esp, edi
jmp 0x1000dd67
mov edi, esp
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 4]
mov eax, dword [esi + 0x5c]
mov eax, dword [eax]
mov eax, dword [eax]
add eax, 0x10
xor edx, edx
mov dword [ebx + 4], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
push eax
call fcn.10007eb6
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, 0x118
add eax, ecx
mov dword [ebx], eax
call fcn.10011fc0
add esp, 0x1c
mov eax, 0x52510ae
mov esp, edi
jmp 0x1000dd67
lea eax, [esi + 0x158]
push eax
lea ebx, [esi + 0xb0]
push ebx
call fcn.1005c116
add esp, 8
lea edi, [esi + 0xf8]
mov ecx, edi
push ebx
call fcn.1000e666
mov ecx, ebx
call fcn.1000e7f4
mov ecx, edi
call fcn.1000e86e
lea ecx, [esi + 0xe0]
push ecx
push eax
call fcn.1007e074
add esp, 8
test eax, eax
mov eax, 0x83eec1c6
mov ecx, 0x9710b1ea
cmove eax, ecx
jmp 0x1000dd67
cmp eax, 0x52510ae
jne 0x1000dd67
mov edi, esp
push eax
sub esp, 0x18
mov ebx, esp
lea eax, [ebx + 4]
push eax
call fcn.1006febd
add esp, 4
mov eax, dword [esi + 4]
mov ecx, 0x140
add ecx, dword [eax]
mov dword [ebx], ecx
call fcn.10011fc0
add esp, 0x1c
mov esp, edi
mov eax, dword [esi + 0x58]
mov eax, dword [esi + 0x54]
mov eax, dword [esi + 0x50]
mov eax, dword [esi + 0x4c]
mov eax, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
mov eax, dword [esi + 0xa8]
lea ecx, [esi + 0xa8]
push dword [eax + 4]
push ecx
call fcn.1000e8c2
push 0x28
push dword [esi + 0xa8]
call fcn.1000791c
add esp, 8
mov eax, dword [esi + 0x2c]
lea ecx, [esi + 0xc8]
call fcn.100087f0
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0xe0]
call fcn.100087f0
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0xf8]
call fcn.1000e7f4
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x110]
call fcn.100087f0
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x128]
call fcn.100087f0
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x140]
call fcn.100087f0
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x158]
call fcn.100087f0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 8]
call fcn.100087f0
mov ecx, dword [esi + 0x170]
xor ecx, ebp
call fcn.100879aa
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret