Function at 0x11074cd0
Capabilities:
Create thread
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111833e4
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 0x18]
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], eax
mov dword [esi], 0x111a371c
call fcn.110d1930
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [ebp - 4], edi
call fcn.110d1930
push 0x24
mov byte [ebp - 4], 1
mov dword [esi + 0x40], edi
call fcn.111101b0
add esp, 4
cmp eax, edi
je 0x11075025
mov dword [esi + 0x3c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x3c]
mov byte [ecx + 0x20], 1
mov edx, dword [esi + 0x3c]
mov byte [edx + 0x21], 1
mov eax, dword [ebp + 0xc]
push 0xe404
mov byte [ebp - 4], 2
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], eax
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 3
cmp eax, edi
je 0x11074d9c
mov ecx, eax
call fcn.11070c40
mov edi, eax
mov ecx, dword [ebp + 0x14]
mov ebx, dword [sym.imp.KeRneL32.DLl_InitializeCriticalSection]
lea edx, [edi + 0xc]
mov dword [esi + 0x54], edi
push edx
mov byte [ebp - 4], 2
mov dword [edi], esi
mov dword [edi + 4], ecx
call ebx
lea eax, [edi + 0x24]
push eax
call ebx
lea ecx, [edi + 0x3c]
push ecx
call ebx
lea edx, [edi + 0xdb1c]
push edx
call ebx
lea eax, [edi + 0x54]
push eax
call ebx
lea ecx, [edi + 0x6c]
push ecx
call ebx
cmp dword [0x111ee734], 0
je 0x11074df8
push 0x20a
push 0x111a2458
push 0x111a3920
call fcn.11029a70
add esp, 0xc
push 4
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x11074e1d
push 0
push 1
mov ecx, eax
call fcn.11110de0
jmp 0x11074e1f
xor eax, eax
mov edx, dword [ebp - 0x420]
push 0xf
push edx
lea ebx, [edi + 0x84]
push ebx
mov byte [ebp - 4], 2
mov dword [0x111ee734], eax
call fcn.11164ed0
push eax
call fcn.11081ff0
mov ecx, dword [ebp - 0x414]
add esp, 0x10
push 0
push 1
push 0x111a2dbc
push 0x111a0f78
call fcn.1105e820
test eax, eax
je 0x11074f20
mov ecx, dword [ebp - 0x414]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0
push 0x100
lea edx, [ebp - 0x210]
push edx
push 0x111a3000
push 0x111a0f78
call eax
push 0x100
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KeRneL32.DLl_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x110], 0
lea edx, [edi + 0xdb64]
je 0x11074ecc
lea eax, [ebp - 0x110]
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11074ec0
jmp 0x11074eda
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11074ed0
mov ebx, dword [ebp - 0x414]
mov edx, dword [ebx]
mov edx, dword [edx + 4]
push 0
push 0x200
lea eax, [ebp - 0x410]
push eax
push 0x1119a90c
push 0x111a0f78
mov ecx, ebx
call edx
push 0x100
lea eax, [edi + 0xdc64]
push eax
lea ecx, [ebp - 0x410]
push ecx
push 0
call fcn.110ee9a0
add esp, 0x10
jmp 0x11074f26
mov ebx, dword [ebp - 0x414]
lea edx, [ebp - 0x424]
push edx
push 0
push edi
push 0x11070f90
push 0x4000
push 0
call dword [sym.imp.KeRneL32.DLl_CreateThread]
push eax
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
push 4
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x11074f6e
push 0
push 1
mov ecx, eax
call fcn.11110de0
jmp 0x11074f70
xor eax, eax
push 0x110641a0
push 0xfa
push 0
push 0
mov byte [ebp - 4], 2
mov dword [0x111ee720], eax
call dword [sym.imp.uSEr32.dll_SetTimer]
push edi
push 0
mov dword [edi + 8], eax
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push 0x110692c0
push 0x17
mov ecx, ebx
call edx
mov ecx, dword [0x111ee720]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push edi
push ecx
push 0x20000000
push 0x11069280
push 0x2000004e
mov ecx, ebx
call edx
mov ecx, dword [0x111ee720]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push edi
push ecx
push 0x20000000
push 0x110645a0
push 0x20000076
mov ecx, ebx
call edx
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [edi + 0xdd7c]
call fcn.11088350
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x41c], edi
call fcn.1116305a
push 0x111cd988
lea edx, [ebp - 0x434]
push edx
mov dword [ebp - 0x434], 0x11195404
call fcn.111634b1
lahf
push cs
adc eax, dword [eax]
pop eax
add eax, 0x8b55bb6d
in al, dx
push esi
mov esi, ecx
call fcn.11072a70
test byte [ebp + 8], 1
je 0x1107507a
push esi
call fcn.11162777
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4