Function at 0x1031673
Capabilities:
Check for peb beingdebugged flag
Check systemkerneldebuggerinformation
Create thread
Get system information on windows
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x107342c]
push ebx
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x214], eax
push 2
lea eax, [ebp - 0x210]
push eax
push 0x23
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp byte [ebp - 0x210], bl
jne 0x10316c1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], bl
je 0x1031700
push 0x10304fd
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push ebx
push 0x1014308
push 0x1010d8c
mov dword [0x10749ec], 1
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
test eax, eax
jne 0x1031700
push ebx
mov eax, 0xea60
push eax
push eax
push ebx
push 0x1030ed0
push ebx
call dword [sym.imp.KERNEL32.dll_SetTimerQueueTimer]
push esi
call fcn.0102934e
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jne 0x1031720
push 0x400
call edi
push eax
call esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push ebx
push 0x10142fc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103174d
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01030509
push dword [ebp - 0x214]
call fcn.01030876
test eax, eax
jne 0x103176b
push 0x400
call edi
push eax
call esi
cmp dword [0x1074a18], ebx
je 0x103178c
push 1
push ebx
push 1
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
push 1
push ebx
push 1
call dword [sym.imp.ntdll.dll_RtlSetThreadIsCritical]
add esp, 0x18
cmp dword [0x1074488], ebx
jne 0x1031799
call fcn.0102937b
call fcn.01027413
test eax, eax
jne 0x10317ac
push 0x401
call edi
push eax
call esi
call fcn.0103100f
test eax, eax
jne 0x10317bf
push 0x407
call edi
push eax
call esi
mov eax, dword [0x1074480]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x218]
push eax
push 0x20019
push ebx
push 0x1013d38
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103183e
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x1010db8
push dword [ebp - 0x218]
mov dword [ebp - 0x224], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], 1
jne 0x103183e
mov eax, dword [ebp - 0x214]
mov dword [eax + 0x30], 1
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + 8]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push ebx
push dword [0x10749f4]
push ebx
push ebx
push dword [ebp - 0x214]
call fcn.01027ea8
cmp dword [0x1074488], ebx
jne 0x1031871
call fcn.01030839
cmp dword [0x1074a18], ebx
je 0x1031880
call fcn.01028f6f
jmp 0x10318a7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
je 0x10318a7
push 0xffffffffffffffff
push ebx
call sub.WINSTA.dll_WinStationIsHelpAssistantSession
movzx eax, al
mov dword [0x1074464], eax
push dword [ebp - 0x214]
call fcn.01039c8b
test eax, eax
je 0x10318c8
call fcn.0103d6ac
test eax, eax
je 0x10318c8
call fcn.0101eaf7
test eax, eax
jne 0x10318d2
push 0x40a
call edi
push eax
call esi
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + 8]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x1074a18], ebx
je 0x10318f1
call fcn.0103964b
call fcn.0103a6a5
test eax, eax
jne 0x1031904
push 0x40a
call edi
push eax
call esi
cmp dword [0x1074a18], ebx
je 0x1031912
call dword [sym.imp.USERENV.dll_Ordinal_117]
call fcn.0103afe2
cmp dword [0x1074464], ebx
jne 0x1031924
call sub.KERNEL32.dll_BaseInitAppcompatCacheSupport
call fcn.01029c44
test eax, eax
jne 0x1031937
push 0x403
call edi
push eax
call esi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x214]
mov dword [esi + 0x54], eax
cmp dword [0x1074a18], ebx
je 0x1031958
call fcn.010396c8
push esi
call fcn.0102102a
call fcn.0103dcd0
neg eax
sbb eax, eax
neg eax
mov dword [0x10744a0], eax
je 0x1031984
push 0x10744a4
call fcn.01044f34
test eax, eax
jge 0x1031984
mov dword [0x10744a4], ebx
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
mov dword [0x10749e0], eax
mov dword [0x10749dc], ebx
mov edi, 0x104
je 0x1031a79
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x10142d4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, 0x10116b4
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101da8d
test eax, eax
jl 0x1031a73
push 1
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01030158
test eax, eax
je 0x1031a73
push esi
mov dword [0x10749dc], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
jne 0x1031a0d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
je 0x1031a73
push 2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
je 0x1031a73
push 0x30
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1031a73
push dword [ebp - 0x214]
lea eax, [esi + 4]
push 0x101df1e
push eax
push ebx
push ebx
call dword [ebp - 0x23c]
push 0x20
push 0x7530
push 0x2710
push esi
mov dword [esi], eax
mov eax, dword [ebp - 0x214]
push 0x1034825
mov dword [esi + 0x2c], eax
push ebx
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
jmp 0x1031a79
mov dword [0x10749dc], ebx
push dword [ebp - 0x214]
call fcn.01026133
test eax, eax
jne 0x1031a9a
push 0x408
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x1074464], ebx
jne 0x1031aaf
push dword [ebp - 0x214]
call fcn.01031460
jmp 0x1031ab9
call fcn.01029256
mov dword [0x1074478], eax
cmp dword [0x1074a18], ebx
je 0x1031af5
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push fcn.01030784
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x1031aef
push 0xfffffffffffffff1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1031af5
push ebx
call fcn.01030784
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x1031b1a
push 0x40a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
push esi
call fcn.01030f44
mov eax, dword [ebp - 0x214]
cmp dword [eax + 0x30], ebx
push edi
push esi
je 0x1031b3b
push 0x1014290
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1031b6b
mov edi, 0x1011964
push edi
push 0x1011954
push 0x101128c
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
cmp dword [0x1074a18], ebx
jne 0x1031b6b
cmp dword [0x1074464], ebx
je 0x1031b6b
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov edi, dword [ebp - 0x214]
push 0xc
lea eax, [ebp - 0x238]
push eax
push esi
push edi
call sub.ntdll.dll_RtlCheckProcessParameters
lea eax, [ebp - 0x21c]
push eax
push esi
push edi
mov dword [ebp - 0x21c], ebx
call fcn.0101e78f
test eax, eax
jne 0x1031bab
push 0x402
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.0102fb45
push 0xf
push 0x1014270
push ebx
push ebx
push 1
push 0x1032550
call fcn.01039b85
push 0xe100
push 0x1014250
push ebx
push ebx
push 3
push 0x10315ce
call fcn.01039b85
cmp dword [0x1074a14], ebx
je 0x1031c31
cmp dword [0x1074a18], ebx
je 0x1031bfa
call fcn.0102cc3e
cmp dword [0x1074a14], ebx
je 0x1031c31
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
je 0x1031c31
push ebx
call sub.WINSTA.dll_WinStationAutoReconnect
test eax, eax
jl 0x1031c31
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
push ebx
push 0x1014238
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
jne 0x1031c50
push 0x400
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1014224
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1031c67
mov byte [0x10749e4], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x230], 6
pop esi
jne 0x1031c7e
push edi
call fcn.01038034
cmp dword [0x1074a14], ebx
je 0x1031cd2
mov eax, dword [edi + 0x38]
cmp eax, 5
je 0x1031c98
cmp eax, 0xb
je 0x1031c98
cmp eax, 0xa
jne 0x1031cb8
cmp dword [0x1074a18], ebx
jne 0x1031cb1
cmp dword [ebp - 0x21c], ebx
je 0x1031cb1
mov dword [edi + 0x38], 2
jmp 0x1031cb8
push eax
push edi
call fcn.0101f811
push 1
call sub.MSGINA.dll_Ordinal_12
cmp dword [0x1074a18], ebx
je 0x1031cdb
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x1031cdb
push dword [edi + 0x38]
push edi
call fcn.0101f811
push 0x405
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop ebx
call fcn.0103e4d8
leave
ret 0x10