Function at 0x1002d2d1
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
sub esp, 0x54
lea ebp, [esp - 4]
mov eax, dword [0x10112038]
xor eax, ebp
mov dword [ebp + 0x54], eax
push 0x3c
mov eax, 0x10097313
call fcn.1008f84a
mov dword [ebp + 0x30], ecx
mov edi, dword [ebp + 0x74]
xor ebx, ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 0x38]
mov esi, SysReAllocStringLen
push eax
lea ecx, [ebp]
mov dword [ebp + 0x38], esi
call sym.ASOHelper.dll_public:_void___thiscall_CRegistry::constructor_struct_HKEY____const_const__
lea ecx, [ebp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [ebp + 0x28]
push eax
mov byte [ebp - 4], 3
call sym.ASOHelper.dll_void___cdecl_ReturnSystweakRegKey_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
lea ecx, [ebp + 0x38]
mov dword [esp], str.ScanStatusForLauncher
call dword [0x100b6094]
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x28]
push eax
mov byte [ebp - 4], 4
call sym.ASOHelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__
pop ecx
pop ecx
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x30]
lea eax, [ebp + 0x1c]
push eax
call sym.ASOHelper.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______thiscall_CSystweakApp::ConvertAppIdTOString_unsigned_int_
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x28]
push eax
mov byte [ebp - 4], 5
call sym.ASOHelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__
pop ecx
pop ecx
push 1
push dword [ebp + 0x28]
lea ecx, [ebp]
push esi
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::Open_struct_HKEY_____wchar_t_const___bool_
test eax, eax
je 0x1002d3fd
lea eax, [ebp + 0x60]
push eax
push str.ErrorCount
lea ecx, [ebp]
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteDWORD_wchar_t_const___unsigned_long_int_const__
lea eax, [ebp + 0x68]
push eax
push str.iconStatus
lea ecx, [ebp]
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteDWORD_wchar_t_const___unsigned_long_int_const__
push ebx
push dword [ebp + 0x6c]
lea ecx, [ebp]
push 0x100bed90
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_
push ebx
push dword [ebp + 0x70]
lea ecx, [ebp]
push str.MSGOnHome
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_
cmp edi, ebx
je 0x1002d3f5
push edi
lea edi, [ebp + 0x38]
call fcn.10036c51
push ebx
push dword [ebp + 0x38]
lea ecx, [ebp]
push str.LastScanDateTime
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_
mov ecx, edi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp]
call sym.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_
cmp byte [sym.ASOHelper.dll_bool_CDlgMainWnd::m_bRunHiddenly], bl
jne 0x1002d5d7
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 0x20], esp
mov esi, str.aso3.exe
push esi
call dword [0x100b6094]
mov ecx, dword [ebp + 0x30]
call sym.ASOHelper.dll_public:_bool___thiscall_CSystweakApp::IsApplicationRunning_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____unsigned_long_int__bool_
cmp al, bl
je 0x1002d5d7
mov edi, str.regopts
push edi
lea ecx, [ebp + 0x34]
call dword [0x100b6094]
mov eax, dword [ebp + 0x64]
add eax, 0xfffffffd
mov byte [ebp - 4], 6
cmp eax, 0x15
ja case.0x1002d452.6
movzx eax, byte [eax + 0x1002d645]
jmp dword [eax*4 + 0x1002d625]
push edi
jmp 0x1002d484
push str.diskopts
jmp 0x1002d484
push str.secpriv
jmp 0x1002d484
push str.winopts
jmp 0x1002d484
push str.backrecv
jmp 0x1002d484
push str.cmnprbfix
jmp 0x1002d484
push str.regmaint
lea ecx, [ebp + 0x34]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_4]
push esi
lea ecx, [ebp + 0x30]
call dword [0x100b6094]
lea ecx, [ebp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 8
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [ebp + 0x2c]
push ecx
push eax
call sym.ASOHelper.dll_wchar_t_const____cdecl_GetAppPath_struct_HINSTANCE_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
pop ecx
pop ecx
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x38]
call dword [0x100b6030]
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x38]
push eax
mov byte [ebp - 4], 9
call sym.ASOHelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__
pop ecx
pop ecx
lea ecx, [ebp + 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Trim]
mov esi, str.open
lea edi, [ebp + 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp + 0x48]
stosd dword es:[edi], eax
mov esi, 0x100beddc
lea edi, [ebp + 0x4c]
movsd dword es:[edi], dword [esi]
push 0x3c
movsw word es:[edi], word [esi]
pop esi
push esi
lea eax, [ebp - 0x48]
push ebx
push eax
call sub.MSVCR90.dll_memset
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x34]
add esp, 0xc
mov dword [ebp - 0x48], esi
cmp dword [eax - 0xc], ebx
je 0x1002d539
lea eax, [ebp + 0x34]
jmp 0x1002d54d
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x20]
call dword [0x100b6094]
mov dword [ebp + 0x24], 1
test byte [ebp + 0x24], 1
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
je 0x1002d561
lea ecx, [ebp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [ebp - 0x44], 0x800040
mov dword [ebp - 0x2c], 1
call fcn.100157c3
test eax, eax
je 0x1002d58c
call fcn.100157c3
cmp eax, ebx
jne 0x1002d586
mov dword [ebp - 0x40], ebx
jmp 0x1002d58c
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x40], eax
push str.SystemProtector.exe
lea ecx, [ebp + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
jne 0x1002d5a9
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp + 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x30]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x34]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp]
call sym.ASOHelper.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_
lea ecx, [ebp + 0x6c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x70]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x54]
xor ecx, ebp
call fcn.1008e7ae
add ebp, 0x58
leave
ret 0x18