Function at 0x10035a20
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4e2c
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x100e01f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x63c], 0x1000
push 0x9872
mov ecx, dword [0x100e28bc]
call fcn.1002c650
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x640], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [ebp - 0x640], 0
jne 0x10035aa7
or eax, 0xffffffff
jmp 0x10035e8e
push 0x98b9
mov ecx, dword [0x100e28bc]
call fcn.1002c650
push eax
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x10035aeb
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xfffffffe
jmp 0x10035e8e
cmp dword [ebp - 0x63c], 0x80000
jae 0x10035b8b
mov edx, dword [ebp - 0x63c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x10035b25
mov dword [ebp - 0x634], 0xfffffffd
jmp 0x10035b8b
lea eax, [ebp - 0x654]
push eax
mov ecx, dword [ebp - 0x63c]
push ecx
mov edx, dword [ebp - 0x638]
push edx
push 5
call dword [ebp - 0x644]
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jne 0x10035b53
jmp 0x10035b8b
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x634], 0xc0000004
je 0x10035b78
mov dword [ebp - 0x634], 0xfffffffc
jmp 0x10035b8b
mov ecx, dword [ebp - 0x63c]
shl ecx, 1
mov dword [ebp - 0x63c], ecx
jmp 0x10035aeb
mov edx, dword [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x634], 0
je 0x10035bac
mov eax, dword [ebp - 0x634]
jmp 0x10035e8e
push 0x98e5
mov ecx, dword [0x100e28bc]
call fcn.1002c650
mov dword [ebp - 0x648], eax
mov eax, dword [0x100e29b0]
and eax, 1
jne 0x10035bf9
mov ecx, dword [0x100e29b0]
or ecx, 1
mov dword [0x100e29b0], ecx
mov edx, dword [ebp - 0x648]
push edx
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100e29b4], eax
cmp dword [0x100e29b4], 0
jne 0x10035c2c
mov eax, dword [ebp - 0x648]
push eax
push 0x6b55
mov ecx, dword [0x100e28bc]
call fcn.1002c720
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100e29b4], eax
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x100e29b4]
mov edx, dword [0x100e29b0]
and edx, 2
jne 0x10035c9f
mov eax, dword [0x100e29b0]
or eax, 2
mov dword [0x100e29b0], eax
mov dword [ebp - 4], 0
push 0x992e
mov ecx, dword [0x100e28bc]
call fcn.1002c650
push eax
push 0x6b55
mov ecx, dword [0x100e28bc]
call fcn.1002c720
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100e29b8], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x100e29b0]
and ecx, 4
jne 0x10035cef
mov edx, dword [0x100e29b0]
or edx, 4
mov dword [0x100e29b0], edx
mov dword [ebp - 4], 1
push str.IsImmersiveProcess
push 0x9bea
mov ecx, dword [0x100e28bc]
call fcn.1002c720
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100e29bc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x62c], eax
mov ecx, 1
test ecx, ecx
je 0x10035e56
mov edx, dword [ebp - 0x62c]
cmp dword [edx + 0x3c], 0
je 0x10035e30
push 0x104
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax + 0x3c]
push ecx
lea edx, [ebp - 0x628]
push edx
call fcn.1007dbd7
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.1007dc21
add esp, 8
test eax, eax
jne 0x10035e30
mov dword [ebp - 0x64c], 1
cmp dword [ebp + 0xc], 1
jne 0x10035e2e
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0x44]
push eax
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x10035e16
push 0
push 2
push 6
call fcn.1001a560
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x10035dbe
cmp dword [0x100e29bc], 0
je 0x10035dbe
mov edx, dword [ebp - 0x630]
push edx
call dword [0x100e29bc]
test eax, eax
jne 0x10035e16
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x630]
push ecx
call dword [0x100e29b4]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.1007dc21
add esp, 8
test eax, eax
je 0x10035e0e
push 0
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10035e0e
mov dword [ebp - 0x650], 1
push 0x32
call dword [0x100e29b8]
cmp dword [ebp - 0x630], 0
je 0x10035e2c
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10035e30
jmp 0x10035e56
mov eax, dword [ebp - 0x62c]
cmp dword [eax], 0
jne 0x10035e3d
jmp 0x10035e56
mov ecx, dword [ebp - 0x62c]
mov edx, dword [ebp - 0x62c]
add edx, dword [ecx]
mov dword [ebp - 0x62c], edx
jmp 0x10035cfb
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x64c], 0
jne 0x10035e73
mov eax, 0xfffffffb
jmp 0x10035e8e
cmp dword [ebp + 0xc], 1
jne 0x10035e89
cmp dword [ebp - 0x650], 0
jne 0x10035e89
mov eax, 0xfffffffa
jmp 0x10035e8e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ab33
mov esp, ebp
pop ebp
ret