Function at 0x10061d40
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100bb52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
push edi
sub esp, 0xc
lea ecx, [esp + 0x30]
call fcn.10001000
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push 4
call fcn.10035e2f
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], 0
test eax, eax
je 0x10061da5
mov ecx, eax
call fcn.1007a010
mov esi, eax
jmp 0x10061da7
xor esi, esi
mov dword [esp + 0x5c], 0xffffffff
call fcn.100779a0
test esi, esi
je 0x10061dc0
push ecx
mov ecx, esi
call fcn.100014e0
call fcn.10062210
push 4
mov dword [esp + 0x20], eax
call fcn.10035e2f
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], 1
test eax, eax
je 0x10061dee
mov ecx, eax
call fcn.10080ce0
mov ebx, eax
jmp 0x10061df0
xor ebx, ebx
mov dword [esp + 0x5c], 0xffffffff
call fcn.10080ba0
mov esi, eax
call fcn.10080b10
mov dword [esp + 0x18], eax
call fcn.10080a80
mov ebp, eax
xor edi, edi
call fcn.10080c40
cmp al, 1
jne 0x10061e29
call fcn.10080a00
mov ecx, 1
cmp al, cl
cmove edi, ecx
test ebx, ebx
je 0x10061e35
push ecx
mov ecx, ebx
call fcn.100014c0
test esi, esi
jne 0x10061e3e
call fcn.10062410
cmp dword [esp + 0x18], 0
je 0x10061e58
push 0x2710
call dword [0x1010d0fc]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x14], 0
call fcn.10080c40
test al, al
jne 0x10061eaa
cmp ebp, 1
je 0x10061e7b
test edi, edi
jne 0x10061e7b
cmp esi, 1
je 0x10061e82
test esi, esi
je 0x10061ec0
cmp dword [esp + 0x1c], 0
je 0x10061ec0
push 0x788
call fcn.10035e2f
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], 2
test eax, eax
je 0x10061ee0
mov ecx, eax
call fcn.10077250
mov edi, eax
jmp 0x10061ee2
test ebp, ebp
jne 0x10061e7b
call fcn.100808e0
test eax, eax
jne 0x10061e7b
test edi, edi
jne 0x10061e7b
cmp esi, 1
je 0x10061e82
call fcn.100620f0
test eax, eax
jne 0x10061f9f
push 0x2710
call dword [0x1010d0fc]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor edi, edi
push 0x5a
push 0
mov dword [esp + 0x64], 0xffffffff
call fcn.1007bd90
push 0x10110b98
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0x5a
push 0
mov esi, eax
call fcn.1007bd00
test esi, esi
je 0x10061f2d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x5a
push 0
call fcn.1007bd90
push 0x10110b98
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x5a
push 0
mov esi, eax
call fcn.1007bd00
test esi, esi
je 0x10061f83
call dword [0x1010cfe8]
cmp eax, 0xb7
je 0x10061f83
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x10065e60
push 0
push 0
call dword [0x1010cf54]
mov ecx, edi
call fcn.10076f70
jmp 0x10061fb7
push esi
call dword [0x1010cf2c]
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x10065b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 4
call fcn.10035e2f
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], 3
test eax, eax
je 0x10061fdc
mov ecx, eax
call fcn.10080ce0
mov esi, eax
jmp 0x10061fde
xor esi, esi
mov dword [esp + 0x5c], 0xffffffff
call fcn.10080ba0
mov ebx, eax
test esi, esi
je 0x10061ff9
push ecx
mov ecx, esi
call fcn.100014c0
push 0x208
call fcn.1001a154
add esp, 4
mov esi, eax
push 0x104
push 0
push esi
call fcn.1003a580
add esp, 0xc
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [0x1010cea8]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10062032
sub ecx, edx
sar ecx, 1
cmp ecx, 0xa
jbe 0x10062083
mov edx, esi
lea ecx, [edx + 2]
jmp 0x10062050
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10062050
sub edx, ecx
mov ecx, esi
sar edx, 1
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10062064
sub ecx, edi
sar ecx, 1
cmp word [esi + edx*2 - 0xc], 0x53
jne 0x10062083
cmp word [esi + ecx*2 - 0xa], 0x45
je 0x100620d0
test ebx, ebx
jne 0x100620d0
push ebx
push ebx
push ebx
lea eax, [esp + 0x40]
push eax
call dword [0x1010ceb8]
test eax, eax
je 0x100620d0
lea esp, [esp]
cmp eax, 0xffffffff
je 0x100620bb
lea eax, [esp + 0x34]
push eax
call dword [0x1010cedc]
lea eax, [esp + 0x34]
push eax
call dword [0x1010ceb0]
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call dword [0x1010ceb8]
test eax, eax
jne 0x100620a0
mov ecx, dword [esp + 0x54]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10