Function at 0x100c1f10
Capabilities:
Create directory
Create thread
Enumerate gui resources
Enumerate process modules
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101affb9
mov eax, dword fs:[0]
push eax
mov eax, 0x1640
call fcn.101a85d0
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14d0], ecx
push 0x100c1e70
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call fcn.100010f0
mov dword [0x10229b80], eax
cmp dword [0x10229bc4], 0
jne 0x100c1f70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10229bc4], eax
cmp dword [0x10229b38], 0
jne 0x100c1f95
push 0
push 4
push 0x10229b38
push 0xf58f70
mov ecx, dword [0x10229bc4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
push 1
lea ecx, [ebp - 0x164c]
call fcn.100ca780
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0x14ed]
push edx
push 0x101f2618
lea ecx, [ebp - 0x1568]
call fcn.100dd380
mov ecx, eax
call fcn.10049e40
push eax
lea ecx, [ebp - 0x11d0]
call fcn.10008f80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x11d0]
push eax
call fcn.100af7b0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100c1ffa
mov dword [ebp - 0x1518], 1
jmp 0x100c2004
mov dword [ebp - 0x1518], 0
mov dl, byte [ebp - 0x1518]
mov byte [ebp - 0x14d1], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11d0]
call fcn.10008ea0
movzx eax, byte [ebp - 0x14d1]
test eax, eax
je 0x100c2053
push 0
movzx ecx, byte [ebp - 0x14ee]
push ecx
push 0x101f261c
lea ecx, [ebp - 0x1564]
call fcn.100dd3c0
mov ecx, eax
call fcn.10049e40
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push 0x40
push 2
movzx edx, byte [ebp - 0x14ef]
push edx
push str.init_log.txt
lea ecx, [ebp - 0x1308]
call fcn.10079750
mov ecx, eax
call fcn.100206a0
push eax
lea ecx, [ebp - 0x164c]
call fcn.100ca6c0
nop
push 0x101d18bf
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1cc
call fcn.10008e10
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1f8], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1f9], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x204], 0
mov eax, dword [ebp - 0x14d0]
mov dword [eax + 0x1c8], 0
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x1ec], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1fa], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1fb], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1fc], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1fd], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1fe], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1ff], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x200], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x201], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x203], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x210], 0
push 0
push 1
mov eax, dword [ebp - 0x14d0]
add eax, 0x204
push eax
mov ecx, dword [0x10229b38]
add ecx, 0xcf0
push ecx
mov edx, dword [0x10229bc4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x14d0]
mov dword [eax + 0x1e8], 1
xor ecx, ecx
mov word [ebp - 0x14e0], cx
lea edx, [ebp - 0x14e0]
push edx
lea eax, [ebp - 0x14fc]
push eax
call fcn.100af900
add esp, 8
movzx ecx, word [ebp - 0x14fc]
movzx edx, word [ebp - 0x14e0]
add ecx, edx
mov eax, dword [ebp - 0x14d0]
mov dword [eax + 0x254], ecx
mov dword [ebp - 0x14cc], 0x1a8
mov dword [ebp - 0x14e4], 0
push 0x100dda10
movzx ecx, byte [ebp - 0x14f0]
push ecx
push str.___RPGuarD_Initializing___
lea ecx, [ebp - 0x1324]
call fcn.100dd400
mov ecx, eax
call fcn.10075310
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100dd730
add esp, 8
mov ecx, eax
call fcn.100ca9d0
nop
push 0
lea eax, [ebp - 0x14cc]
push eax
mov ecx, dword [ebp - 0x14e4]
push ecx
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x100c2353
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x156c], esp
lea edx, [ebp - 0x14a8]
push edx
call fcn.10008f80
mov dword [ebp - 0x1570], eax
mov byte [ebp - 4], 2
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1578], esp
mov eax, dword [ebp - 0x14d0]
add eax, 0x214
push eax
call fcn.100cc050
mov byte [ebp - 4], 0
call fcn.100c1d70
add esp, 0x2c
mov byte [ebp - 0x14d2], al
movzx ecx, byte [ebp - 0x14d2]
test ecx, ecx
je 0x100c22b5
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
jmp 0x100c2227
lea eax, [ebp - 0x14a8]
push eax
lea ecx, [ebp - 0x1224]
call fcn.10008f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1224]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x214
call fcn.100089d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1224]
call fcn.10008ea0
nop
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
push 0x100dda10
lea eax, [ebp - 0x14a8]
push eax
movzx ecx, byte [ebp - 0x14f1]
push ecx
push str._______GPU:
lea ecx, [ebp - 0x1250]
call fcn.100dda40
mov ecx, eax
call fcn.1003f7c0
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100dd730
add esp, 8
push eax
call fcn.100dd730
add esp, 8
mov ecx, eax
call fcn.100ca9d0
nop
jmp 0x100c2227
push 0x101d18d2
mov ecx, 0x102afa0c
call fcn.10008e10
nop
mov eax, dword [ebp - 0x14d0]
add eax, 0x214
mov dword [ebp - 0x1514], eax
mov ecx, dword [ebp - 0x1514]
call fcn.100088e0
mov dword [ebp - 0x14ec], eax
mov ecx, dword [ebp - 0x1514]
call fcn.100088c0
mov dword [ebp - 0x1540], eax
jmp 0x100c23a7
mov ecx, dword [ebp - 0x14ec]
add ecx, 0x1c
mov dword [ebp - 0x14ec], ecx
mov edx, dword [ebp - 0x14ec]
cmp edx, dword [ebp - 0x1540]
je 0x100c2451
mov eax, dword [ebp - 0x14ec]
push eax
lea ecx, [ebp - 0x1208]
call fcn.10009070
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1208]
push ecx
movzx edx, byte [ebp - 0x14f2]
push edx
push 0x101f2670
lea ecx, [ebp - 0x1174]
call fcn.100ddbd0
mov ecx, eax
call fcn.100280b0
push eax
lea eax, [ebp - 0x12f8]
push eax
call fcn.100d0a20
add esp, 0xc
mov dword [ebp - 0x1558], eax
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x1560], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1560]
push edx
mov ecx, 0x102afa0c
call fcn.1008b920
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12f8]
call fcn.10008ea0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1208]
call fcn.10008ea0
nop
jmp 0x100c2398
lea eax, [ebp - 0x159c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x164], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
lea esi, [ebp - 0x164]
mov eax, connect
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x164]
mov dword [ebp - 0x155c], ecx
push 0x40
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.10153ba0
add esp, 0xc
mov dword [ebp - 0x14d8], connect
jmp 0x100c24d6
mov eax, dword [ebp - 0x14d8]
add eax, 1
mov dword [ebp - 0x14d8], eax
mov ecx, dword [ebp - 0x14d8]
cmp ecx, dword [ebp - 0x155c]
ja 0x100c259c
lea esi, [ebp - 0x164]
mov eax, dword [ebp - 0x14d8]
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14d8], 0x80000002
jne 0x100c2535
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x44], edx
jmp 0x100c2597
cmp dword [ebp - 0x14d8], 0x80000003
jne 0x100c2567
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x34], eax
jmp 0x100c2597
cmp dword [ebp - 0x14d8], reloc.WS2_32.dll_connect
jne 0x100c2597
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x24], ecx
jmp 0x100c24c7
mov edx, dword [ebp - 0x1588]
push edx
lea eax, [ebp - 0x1288]
push eax
call fcn.1001e240
add esp, 8
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1550]
mov dword [ebp - 0x1554], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x126c]
call fcn.10008f80
mov dword [ebp - 0x1544], eax
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1538], eax
mov byte [ebp - 4], 7
movzx ecx, byte [ebp - 0x14f3]
push ecx
push 0x101f2680
lea ecx, [ebp - 0x116c]
call fcn.100ddc50
mov ecx, eax
call fcn.100280b0
push eax
mov edx, dword [ebp - 0x1538]
push edx
lea eax, [ebp - 0x12a4]
push eax
call fcn.100cf390
add esp, 0xc
mov dword [ebp - 0x1548], eax
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x153c], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1554]
push edx
mov eax, dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.100cf950
add esp, 0xc
mov dword [ebp - 0x154c], eax
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0x151c], edx
mov byte [ebp - 4], 9
movzx eax, byte [ebp - 0x14f5]
push eax
push str._Core_s_
lea ecx, [ebp - 0x1230]
call fcn.10063790
mov ecx, eax
call fcn.100111e0
push eax
mov ecx, dword [ebp - 0x151c]
push ecx
lea edx, [ebp - 0x12dc]
push edx
call fcn.100cf390
add esp, 0xc
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x1520]
push eax
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x224
call fcn.10012020
lea ecx, [ebp - 0x12dc]
call fcn.10008ea0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12c0]
call fcn.10008ea0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x12a4]
call fcn.10008ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x126c]
call fcn.10008ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1288]
call fcn.10008ea0
nop
push 0x100dda10
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x224
call fcn.10008c60
push eax
movzx ecx, byte [ebp - 0x14f4]
push ecx
push str._______CPU:
lea ecx, [ebp - 0x1240]
call fcn.100ddcd0
mov ecx, eax
call fcn.1003f7c0
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100dd730
add esp, 8
push eax
call fcn.100dd730
add esp, 8
mov ecx, eax
call fcn.100ca9d0
nop
mov eax, dword [ebp - 0x14d0]
add eax, 0x224
push eax
mov ecx, 0x102af7c4
call fcn.10008e30
call fcn.100af7f0
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x208], eax
mov dword [ecx + 0x20c], edx
push 8
call fcn.10150df0
add esp, 4
mov dword [ebp - 0x1508], eax
cmp dword [ebp - 0x1508], 0
je 0x100c27c0
xor edx, edx
mov eax, dword [ebp - 0x1508]
mov dword [eax], edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
jmp 0x100c27ca
mov dword [ebp - 0x1510], 0
mov edx, dword [ebp - 0x1510]
mov dword [ebp - 0x1500], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1524], eax
lea eax, [ebp - 0x1184]
push eax
mov ecx, dword [ebp - 0x1524]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x1500]
mov eax, dword [ebp - 0x1178]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x117c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x14d0]
mov ecx, dword [ebp - 0x1500]
mov dword [eax + 0x240], ecx
lea edx, [ebp - 0x1528]
push edx
push 0x1000
lea eax, [ebp - 0x1164]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100c2a1b
mov ecx, dword [ebp - 0x1528]
shr ecx, 2
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x14dc], 0
jmp 0x100c2870
mov edx, dword [ebp - 0x14dc]
add edx, 1
mov dword [ebp - 0x14dc], edx
mov eax, dword [ebp - 0x14dc]
cmp eax, dword [ebp - 0x152c]
jae 0x100c2a1b
mov ecx, dword [ebp - 0x14dc]
cmp dword [ebp + ecx*4 - 0x1164], 0
je 0x100c2a16
mov edx, dword [ebp - 0x14dc]
mov eax, dword [ebp + edx*4 - 0x1164]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0x1504], 0
je 0x100c2a16
lea ecx, [ebp - 0x1574]
push ecx
push 4
lea edx, [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100c2a16
push 0x104
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea ecx, [ebp - 0x11b4]
call fcn.100c2aa0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [ebp - 0x11b4], edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x11b0]
call fcn.10008e10
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [0x10229ad4], edx
mov ecx, 0x102af9fc
call fcn.10008900
push 0
push 0x100c1c70
call dword [sym.imp.USER32.dll_EnumWindows]
nop
mov dword [ebp - 0x150c], 0x102af9fc
mov ecx, dword [ebp - 0x150c]
call fcn.100088e0
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x150c]
call fcn.100088c0
mov dword [ebp - 0x1534], eax
jmp 0x100c29a5
mov eax, dword [ebp - 0x14e8]
add eax, 0x1c
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x14e8]
cmp ecx, dword [ebp - 0x1534]
je 0x100c29ee
mov edx, dword [ebp - 0x14e8]
push edx
lea ecx, [ebp - 0x11ec]
call fcn.10009070
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x11ec]
push eax
lea ecx, [ebp - 0x1194]
call fcn.100089f0
nop
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11ec]
call fcn.10008ea0
nop
jmp 0x100c2996
lea ecx, [ebp - 0x11b4]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x244
call fcn.100cbef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11b4]
call fcn.100c2b00
nop
jmp 0x100c2861
lea ecx, [ebp - 0x164c]
call fcn.100ca680
mov edx, dword [ebp - 0x14d0]
add edx, 0x244
push edx
mov ecx, 0x102af898
call fcn.100cbe70
push 0
push 0
mov eax, dword [ebp - 0x14d0]
push eax
push 0x100ae650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x16c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164c]
call fcn.100c2ad0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret