Function at 0x97c6f0
Capabilities:
Acquire debug privileges
Create thread
Terminate thread

Disassembly:
sub esp, 0x47c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x484]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], edi
cmp dword [0xc00c7c], edi
jne 0x97c7a6
mov ecx, 0xab713c
call fcn.0094c620
mov dword [0xc00c7c], eax
test eax, eax
jne 0x97c73f
xor eax, eax
jmp 0x97cd89
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwQuerySystemInformation
push eax
call esi
mov ecx, dword [0xc00c7c]
push str.ZwDuplicateObject
push ecx
mov dword [0xc0ed64], eax
call esi
mov edx, dword [0xc00c7c]
push str.ZwQueryObject
push edx
mov dword [0xc0ed60], eax
call esi
mov dword [0xc0ed5c], eax
mov eax, dword [0xc00c7c]
push str.ZwClose
push eax
call esi
mov dword [0xc0e9e0], eax
cmp dword [0xc0ed5c], edi
je 0x97c738
cmp dword [0xc0ed60], edi
je 0x97c738
cmp dword [0xc0ed64], edi
je 0x97c738
test eax, eax
je 0x97c738
mov ecx, str.SeDebugPrivilege
call fcn.0095fcc0
mov ecx, dword [esp + 0x490]
push ecx
push 0x40
call fcn.0097af50
mov ebx, eax
add esp, 8
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x97c738
xor ecx, ecx
mov eax, 0x1000
mov dword [esp + 0x10], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a77370
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
lea edx, [ecx*4]
push edx
push eax
push 0x10
mov dword [esp + 0x30], eax
call dword [0xc0ed64]
cmp eax, 0xc0000004
jne 0x97c866
mov eax, dword [esp + 0x20]
push eax
call fcn.00a7a976
mov eax, dword [esp + 0x14]
add eax, eax
xor ecx, ecx
add esp, 4
mov dword [esp + 0x10], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a77370
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
lea edx, [ecx*4]
push edx
push eax
push 0x10
mov dword [esp + 0x30], eax
call dword [0xc0ed64]
cmp eax, 0xc0000004
je 0x97c814
mov esi, dword [esp + 0x20]
xor ebp, ebp
mov dword [esp + 0x30], ebp
cmp dword [esi], ebp
jbe 0x97cd47
lea edi, [esi + 0x10]
mov dword [esp + 0x18], edi
jmp 0x97c885
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x490]
cmp dword [edi - 0xc], eax
jne 0x97cd25
movzx eax, word [edi - 6]
push 4
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
push eax
push ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ebp
call dword [0xc0ed60]
test eax, eax
jne 0x97cd25
push 0x34
push eax
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x4c], eax
call fcn.00a7ffb0
mov edx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x38
lea ecx, [esp + 0x48]
push ecx
push 0
push edx
call dword [0xc0ed5c]
test eax, eax
jge 0x97c905
mov eax, dword [esp + 0x14]
push eax
call fcn.0097cfc0
add esp, 4
jmp 0x97cd25
cmp dword [0xbd85e8], 0
mov al, byte [edi - 8]
je 0x97c948
mov edx, dword [esp + 0x4c]
movzx ecx, al
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x44]
add edx, 0xfffffffe
push edx
movzx edx, byte [edi - 7]
dec eax
push eax
mov eax, dword [edi]
push ecx
movzx ecx, word [edi - 6]
push edx
mov edx, dword [edi - 4]
push eax
push ecx
push edx
push str._p__04hx__6lx__2x__3lx__3ld__4ld__2d
push 0
call fcn.0096a780
add esp, 0x28
mov eax, dword [esp + 0x68]
add eax, 0x400
push eax
push 0x40
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov eax, dword [esp + 0x14]
test esi, esi
jne 0x97c976
push eax
call fcn.0097cfc0
add esp, 4
jmp 0x97cd25
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push esi
push 2
push eax
call dword [0xc0ed5c]
test eax, eax
jl 0x97cade
mov ecx, dword [esi + 4]
push ecx
lea ebx, [esp + 0x20]
call fcn.00970520
add esp, 4
cmp eax, 1
jne 0x97ca43
mov edi, dword [esp + 0x1c]
mov eax, str.File
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x97ca07
cmp dword [0xbd85e8], 0
je 0x97c9e1
movzx eax, word [esi]
mov edx, dword [esi + 4]
push edx
shr eax, 1
push eax
push str.__14.ws_n
push 0
call fcn.0096a780
add esp, 0x10
push edi
call fcn.00a78fec
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0097cfc0
mov edi, dword [esp + 0x1c]
add esp, 4
jmp 0x97cd25
push edi
mov ebp, 1
call fcn.00a78fec
add esp, 4
cmp dword [0xbd85e8], 0
mov dword [esp + 0x1c], 0
je 0x97ca3f
movzx eax, word [esi]
mov edx, dword [esi + 4]
push edx
shr eax, 1
push eax
push str.__14.ws
push 0
call fcn.0096a780
add esp, 0x10
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
cmp eax, 0x12019f
je 0x97cbdd
cmp eax, 0x100000
je 0x97cbdd
test eax, 0x20000
jne 0x97cbdd
cmp eax, 0x120089
je 0x97cbdd
test ebp, ebp
je 0x97caa7
cmp eax, 0x120189
je 0x97cbe5
cmp eax, 0x1a019f
je 0x97cbe5
cmp eax, 0x120196
je 0x97cbe5
test byte [edi - 7], 2
jne 0x97cbe5
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x97cab4
mov eax, 0x800
add eax, 0x400
push eax
push 0x40
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x14]
mov esi, eax
test esi, esi
jne 0x97caff
push ecx
call fcn.0097cfc0
add esp, 4
jmp 0x97cd25
cmp dword [0xbd85e8], 0
je 0x97ca43
push str.ZwQueryObject__OTI__FAILED
push 0
call fcn.0096a780
add esp, 8
jmp 0x97ca43
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 1
push ecx
call dword [0xc0ed5c]
test eax, eax
jl 0x97cbb4
mov edx, dword [esi + 4]
push edx
lea ebx, [esp + 0x20]
call fcn.00970520
add esp, 4
cmp eax, 1
jne 0x97cbd1
cmp dword [0xbd85e8], 0
je 0x97cb56
movzx ecx, word [esi]
mov eax, dword [esi + 4]
push eax
shr ecx, 1
push ecx
push str._.ws
push 0
call fcn.0096a780
add esp, 0x10
cmp dword [esp + 0x28], 0
mov edi, dword [esp + 0x1c]
je 0x97cb9b
mov eax, dword [esp + 0x28]
cmp byte [eax], 0
je 0x97cb9b
push 0
push eax
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97cb9b
cmp dword [0xbd85e8], 0
je 0x97cb93
push str.MATCH_A__TRUE
push 0
call fcn.0096a780
add esp, 8
mov dword [esp + 0x24], 1
push edi
call fcn.00a78fec
mov edi, dword [esp + 0x1c]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x97ccd8
cmp dword [0xbd85e8], 0
je 0x97cbd1
mov edx, dword [esp + 0x34]
push edx
push str.ZwQueryObject__ONI__FAILED_for_handle__04hx
push 0
call fcn.0096a780
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x97ccd8
test ebp, ebp
je 0x97ccd8
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x97cbf2
mov eax, 0x800
mov ecx, dword [esp + 0x14]
add eax, 0x400
push eax
lea edx, [esp + 0x80]
push 0xaec054
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x84], ecx
call fcn.00a78f30
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
push 0
lea ecx, [esp + 0x80]
push ecx
push 0x97c5c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x97ccd8
push 0
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
jne 0x97cc65
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x97ccce
cmp byte [esp + 0x7c], 0
je 0x97ccce
cmp dword [0xbd85e8], 0
je 0x97cc89
lea edx, [esp + 0x7c]
push edx
push 0xaa1544
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x97ccce
cmp byte [eax], 0
je 0x97ccce
push 0
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97ccce
cmp dword [0xbd85e8], 0
je 0x97ccc6
push str.MATCH_A1__TRUE
push 0
call fcn.0096a780
add esp, 8
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x18]
push ecx
call fcn.00985290
mov edx, dword [esp + 0x14]
push edx
call fcn.0097cfc0
mov esi, 1
add esp, 4
cmp dword [esp + 0x24], esi
jne 0x97cd25
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
push esi
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
push ecx
push edx
call dword [0xc0ed60]
test eax, eax
jne 0x97cd25
mov eax, dword [esp + 0x14]
push eax
call fcn.0097cfc0
add esp, 4
test eax, eax
je 0x97cd25
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
inc eax
add edi, 0x10
xor ebp, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], edi
cmp eax, dword [esi]
jb 0x97c881
mov edi, dword [esp + 0x38]
cmp dword [0xbd85e8], ebp
je 0x97cd5d
push str.Finished
push ebp
call fcn.0096a780
add esp, 8
push esi
call fcn.00a7a976
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
call fcn.00985290
cmp dword [0xbd85e8], ebp
je 0x97cd87
push edi
push str.returning_c_:_u
push ebp
call fcn.0096a780
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x47c
ret 8