Function at 0x10023180
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005996c
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x63c], 0x1000
push 0xa8a0
mov ecx, dword [0x1007054c]
call fcn.1001bb60
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jne 0x100231f7
or eax, 0xffffffff
jmp 0x100235c5
push 0xa8a8
mov ecx, dword [0x1007054c]
call fcn.1001bb60
push eax
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x1002323b
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xfffffffe
jmp 0x100235c5
cmp dword [ebp - 0x63c], 0x80000
jae 0x100232db
mov edx, dword [ebp - 0x63c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x10023275
mov dword [ebp - 0x634], 0xfffffffd
jmp 0x100232db
lea eax, [ebp - 0x654]
push eax
mov ecx, dword [ebp - 0x63c]
push ecx
mov edx, dword [ebp - 0x638]
push edx
push 5
call dword [ebp - 0x644]
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jne 0x100232a3
jmp 0x100232db
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x634], 0xc0000004
je 0x100232c8
mov dword [ebp - 0x634], 0xfffffffc
jmp 0x100232db
mov ecx, dword [ebp - 0x63c]
shl ecx, 1
mov dword [ebp - 0x63c], ecx
jmp 0x1002323b
mov edx, dword [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x634], 0
je 0x100232fc
mov eax, dword [ebp - 0x634]
jmp 0x100235c5
push 0xa908
mov ecx, dword [0x1007054c]
call fcn.1001bb60
mov dword [ebp - 0x648], eax
mov eax, dword [0x10070614]
and eax, 1
jne 0x10023349
mov ecx, dword [0x10070614]
or ecx, 1
mov dword [0x10070614], ecx
mov edx, dword [ebp - 0x648]
push edx
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10070618], eax
cmp dword [0x10070618], 0
jne 0x1002337c
mov eax, dword [ebp - 0x648]
push eax
push 0x7a7b
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10070618], eax
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10070618]
mov edx, dword [0x10070614]
and edx, 2
jne 0x100233e3
mov eax, dword [0x10070614]
or eax, 2
mov dword [0x10070614], eax
mov dword [ebp - 4], 0
push 0x10065d14
push 0x7a7b
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1007061c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10070614]
and ecx, 4
jne 0x10023433
mov edx, dword [0x10070614]
or edx, 4
mov dword [0x10070614], edx
mov dword [ebp - 4], 1
push str.IsImmersiveProcess
push 0xad93
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10070620], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x62c], eax
mov ecx, 1
test ecx, ecx
je 0x1002358d
mov edx, dword [ebp - 0x62c]
cmp dword [edx + 0x3c], 0
je 0x10023567
push 0x104
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax + 0x3c]
push ecx
lea edx, [ebp - 0x628]
push edx
call fcn.1002ff4b
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.10030517
add esp, 8
test eax, eax
jne 0x10023567
mov dword [ebp - 0x64c], 1
cmp dword [ebp + 0xc], 1
jne 0x10023565
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0x44]
push eax
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x1002354d
call fcn.1002aec0
movzx ecx, al
test ecx, ecx
je 0x100234f5
cmp dword [0x10070620], 0
je 0x100234f5
mov edx, dword [ebp - 0x630]
push edx
call dword [0x10070620]
test eax, eax
jne 0x1002354d
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x630]
push ecx
call dword [0x10070618]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.10030517
add esp, 8
test eax, eax
je 0x10023545
push 0
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10023545
mov dword [ebp - 0x650], 1
push 0x32
call dword [0x1007061c]
cmp dword [ebp - 0x630], 0
je 0x10023563
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10023567
jmp 0x1002358d
mov eax, dword [ebp - 0x62c]
cmp dword [eax], 0
jne 0x10023574
jmp 0x1002358d
mov ecx, dword [ebp - 0x62c]
mov edx, dword [ebp - 0x62c]
add edx, dword [ecx]
mov dword [ebp - 0x62c], edx
jmp 0x1002343f
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x64c], 0
jne 0x100235aa
mov eax, 0xfffffffb
jmp 0x100235c5
cmp dword [ebp + 0xc], 1
jne 0x100235c0
cmp dword [ebp - 0x650], 0
jne 0x100235c0
mov eax, 0xfffffffa
jmp 0x100235c5
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret