Function at 0x1010c311
Capabilities:
Resume thread
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x101dc354]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x24], eax
xor ecx, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ecx
mov esi, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], ecx
push edi
mov edi, ecx
mov dword [esp + 0x38], edi
test eax, eax
jne 0x1010c381
push 0x10042568
mov edx, 0x12e
mov ecx, 0x1004239c
call fcn.100e970f
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [eax], ecx
mov byte [esp + 0x44], cl
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], ebx
call fcn.10099234
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c3c8
push 0x100424ec
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp byte [esp + 0x44], 0
je 0x1010c911
call fcn.100edd2d
jmp 0x1010c911
cmp dword [esp + 0x34], esi
je 0x1010c3cf
int3
lea edx, [esp + 0x34]
call fcn.1010cdcd
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c3e9
push 0x10042548
jmp 0x1010c3a3
cmp byte [esp + 0x44], 0
je 0x1010c3fa
call fcn.100edd2d
mov byte [esp + 0x44], 0
and dword [esp + 0x2c], esi
lea eax, [esp + 0x2c]
push eax
push 0x101deb38
push 6
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x1010c44f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c433
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c44f
push 0x10042590
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1010c911
mov ebx, 0x105
lea eax, [esp + 0x48]
push ebx
push eax
push dword [esp + 0x34]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameW]
test eax, eax
je 0x1010c477
cmp eax, ebx
jne 0x1010c49f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x1010c49f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c496
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c49f
push 0x100425b4
jmp 0x1010c43a
lea eax, [esp + 0x48]
push 0x5c
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x1010c4d5
push 0x100425d8
mov eax, 0x8000ffff
push 1
mov dword [esp + 0x18], eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1010c915
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x48]
push 0x1004256c
push eax
lea eax, [esp + 0x2c]
push 0x10008194
push eax
call fcn.100a6b40
mov ebx, eax
add esp, 0x10
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c50a
push 0x100425f8
jmp 0x1010c43a
cmp dword [esp + 0x18], esi
je 0x1010c511
int3
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x3c]
call fcn.1010c9fa
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c550
push 0x10042620
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1010c90d
xor eax, eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.10177a68
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c57f
push 0x10042640
jmp 0x1010c8f4
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1010c8c5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
je 0x1010c8c5
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push ebx
push ebx
push 2
push eax
push esi
push dword [esp + 0x30]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
jne 0x1010c619
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c5eb
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x1010c5f6
mov ebx, 0x80004005
mov dword [esp + 0x10], ebx
push 0x1004267c
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.100eee97
jmp 0x1010c911
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
cmp dword [esp + 0x20], ebx
je 0x1010c62f
int3
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10177b74
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c673
push 0x100426a8
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.100eee97
mov edi, dword [esp + 0x38]
jmp 0x1010c911
push dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
push dword [esp + 0x44]
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x30]
push 0
push 0
push 0xf001f
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x1010c5cc
mov eax, dword [esp + 0x30]
mov ecx, esi
cdq
push edx
push eax
call fcn.10177dd0
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c6d2
push 0x100426c8
jmp 0x1010c5fb
lea ecx, [esp + 0x40]
call fcn.100eee97
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1010c71e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c709
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x1010c714
mov ebx, 0x80004005
mov dword [esp + 0x10], ebx
push 0x100426f0
jmp 0x1010c43a
mov eax, dword [esp + 0x1c]
xor ebx, ebx
push ebx
push 0x7530
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
push ebx
push eax
push 2
mov dword [esp + 0x58], esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForMultipleObjectsEx]
test eax, eax
je 0x1010c865
cmp eax, 1
je 0x1010c7c1
cmp eax, 0x102
je 0x1010c7ab
cmp eax, 0xffffffff
je 0x1010c777
push 0x1002053c
mov edx, 0x1e1
mov ecx, 0x1004239c
call fcn.100e970f
push 0x10042828
jmp 0x1010c4b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c796
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x1010c7a1
mov ebx, 0x80004005
mov dword [esp + 0x10], ebx
push 0x1004280c
jmp 0x1010c43a
push 0x100427ec
mov ebx, 0x800705b4
push 1
mov dword [esp + 0x18], ebx
push ebx
jmp 0x1010c4c3
push 0x10042718
push 1
push 0x80004005
push 0x2000000
mov dword [esp + 0x48], ebx
call fcn.100ab973
add esp, 0x10
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x1010c831
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
cmp ebx, 0x103
jne 0x1010c808
push 0x10042760
jmp 0x1010c4b7
test ebx, ebx
jne 0x1010c825
push 0x1004278c
push 1
mov dword [esp + 0x18], 0x80004005
push 0x80004005
jmp 0x1010c4c3
jns 0x1010c865
push 0x100427ac
jmp 0x1010c43a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c850
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x1010c85b
mov ebx, 0x80004005
mov dword [esp + 0x10], ebx
push 0x100427c8
jmp 0x1010c43a
cmp dword [esp + 0x3c], 0
je 0x1010c86d
int3
mov edx, dword [edi + 0x18]
lea eax, [esp + 0x3c]
push eax
push ecx
lea ecx, [edi + 0x1c]
call fcn.10177fe1
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c892
push 0x10042850
jmp 0x1010c43a
mov eax, dword [esp + 0x3c]
push dword [esp + 0x28]
push 0x1007771c
mov ecx, dword [eax]
push 0
push eax
mov ebx, dword [ecx + 0xc]
mov ecx, ebx
call dword [0x101e07c0]
call ebx
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x1010c925
push 0x10042874
jmp 0x1010c43a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x1010c8e4
movzx ebx, bx
or ebx, 0x80070000
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x1010c8ef
mov ebx, 0x80004005
mov dword [esp + 0x10], ebx
push 0x10042660
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.100eee97
mov esi, dword [esp + 0x14]
test ebx, ebx
jns 0x1010c925
test esi, esi
je 0x1010c925
push 0x80080005
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1010c942
mov ecx, dword [eax]
push eax
mov ebx, dword [ecx + 8]
mov ecx, ebx
call dword [0x101e07c0]
call ebx
and dword [esp + 0x3c], 0
mov eax, dword [esp + 0x1c]
push 7
pop ebx
test eax, eax
je 0x1010c95c
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x1010c95c
mov ecx, ebx
int 0x29
test edi, edi
je 0x1010c975
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
test eax, eax
jne 0x1010c975
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, ebx
int 0x29
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1010c98c
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x1010c98c
mov ecx, ebx
int 0x29
cmp dword [esp + 0x18], 0
je 0x1010c9a5
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x1010c9a5
mov ecx, ebx
int 0x29
test esi, esi
je 0x1010c9b8
push esi
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x1010c9b8
mov ecx, ebx
int 0x29
cmp dword [esp + 0x34], 0
je 0x1010c9d6
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_RtlFreeSid]
test eax, eax
je 0x1010c9d1
mov ecx, ebx
int 0x29
and dword [esp + 0x34], 0
lea ecx, [esp + 0x24]
call fcn.100b61be
mov ecx, dword [esp + 0x25c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b88c0
mov esp, ebp
pop ebp
ret 0xc