Function at 0x100df830
Capabilities:
Create directory
Create thread
Enumerate gui resources
Enumerate process modules
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bd2e9
mov eax, dword fs:[0]
push eax
mov eax, 0x1640
call fcn.10156900
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14d0], ecx
push 0x100df790
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call fcn.100020f0
mov dword [0x10251b04], eax
cmp dword [0x10251b48], 0
jne 0x100df890
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10251b48], eax
cmp dword [0x10251ac8], 0
jne 0x100df8b4
push 0
push 4
push 0x10251ac8
push 0xf3e860
mov ecx, dword [0x10251b48]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 1
lea ecx, [ebp - 0x164c]
call fcn.100e6d40
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0x14ed]
push edx
push 0x10210120
lea ecx, [ebp - 0x1568]
call fcn.100fb210
mov ecx, eax
call fcn.100cfff0
push eax
lea ecx, [ebp - 0x1224]
call fcn.10045f80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1224]
push eax
call fcn.100d1680
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100df919
mov dword [ebp - 0x1518], 1
jmp 0x100df923
mov dword [ebp - 0x1518], 0
mov dl, byte [ebp - 0x1518]
mov byte [ebp - 0x14d1], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1224]
call fcn.10045ea0
movzx eax, byte [ebp - 0x14d1]
test eax, eax
je 0x100df971
push 0
movzx ecx, byte [ebp - 0x14ee]
push ecx
push 0x1021011c
lea ecx, [ebp - 0x1564]
call fcn.100fb250
mov ecx, eax
call fcn.100cfff0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40
push 2
movzx edx, byte [ebp - 0x14ef]
push edx
push str.init_log.txt
lea ecx, [ebp - 0x1308]
call fcn.100fb290
mov ecx, eax
call fcn.10059fa0
push eax
lea ecx, [ebp - 0x164c]
call fcn.100e6c80
push 0x101f4fe3
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x198
call fcn.10045e10
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1c8], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1c9], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1d5], 0
mov eax, dword [ebp - 0x14d0]
mov dword [eax + 0x1c4], 0
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x1b8], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1ca], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1cb], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1cc], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1cd], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1ce], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1cf], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1d3], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1d0], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1d1], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1d4], 0
xor eax, eax
mov ecx, dword [ebp - 0x14d0]
mov word [ecx + 0x224], ax
mov edx, dword [ebp - 0x14d0]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x228], eax
mov dword [edx + 0x22c], ecx
push 0
push 1
mov edx, dword [ebp - 0x14d0]
add edx, 0x1d5
push edx
mov eax, dword [0x10251ac8]
add eax, 0xce8
push eax
mov ecx, dword [0x10251b48]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x14d0]
mov dword [edx + 0x1b4], 1
xor eax, eax
mov word [ebp - 0x14e0], ax
lea ecx, [ebp - 0x14e0]
push ecx
lea edx, [ebp - 0x14fc]
push edx
call fcn.100d17d0
add esp, 8
movzx eax, word [ebp - 0x14fc]
movzx ecx, word [ebp - 0x14e0]
add eax, ecx
mov edx, dword [ebp - 0x14d0]
mov dword [edx + 0x220], eax
mov dword [ebp - 0x14cc], 0x1a8
mov dword [ebp - 0x14e4], 0
push 0x100fba70
movzx eax, byte [ebp - 0x14f0]
push eax
push str.___HSACSX_Initializing___
lea ecx, [ebp - 0x1324]
call fcn.100fb440
mov ecx, eax
call fcn.100cbe70
push eax
lea ecx, [ebp - 0x164c]
push ecx
call fcn.100fb750
add esp, 8
mov ecx, eax
call fcn.100e6fa0
push 0
lea edx, [ebp - 0x14cc]
push edx
mov eax, dword [ebp - 0x14e4]
push eax
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x100dfc91
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x156c], esp
lea edx, [ebp - 0x14a8]
push edx
call fcn.10045f80
mov dword [ebp - 0x1570], eax
mov byte [ebp - 4], 2
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1578], esp
mov eax, dword [ebp - 0x14d0]
add eax, 0x1e0
push eax
call fcn.100e84b0
mov byte [ebp - 4], 0
call fcn.100df690
add esp, 0x2c
mov byte [ebp - 0x14d2], al
movzx ecx, byte [ebp - 0x14d2]
test ecx, ecx
je 0x100dfbf5
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
jmp 0x100dfb67
lea eax, [ebp - 0x14a8]
push eax
lea ecx, [ebp - 0x1208]
call fcn.10045f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1208]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1e0
call fcn.100459a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1208]
call fcn.10045ea0
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
push 0x100fba70
lea eax, [ebp - 0x14a8]
push eax
movzx ecx, byte [ebp - 0x14f1]
push ecx
push str._______GPU:
lea ecx, [ebp - 0x1250]
call fcn.100fbaa0
mov ecx, eax
call fcn.1005a020
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100fb750
add esp, 8
push eax
call fcn.100fb750
add esp, 8
mov ecx, eax
call fcn.100e6fa0
jmp 0x100dfb67
push 0x101f4fe6
mov ecx, 0x102ce6b4
call fcn.10045e10
mov eax, dword [ebp - 0x14d0]
add eax, 0x1e0
mov dword [ebp - 0x1514], eax
mov ecx, dword [ebp - 0x1514]
call fcn.10041f60
mov dword [ebp - 0x14ec], eax
mov ecx, dword [ebp - 0x1514]
call fcn.100458b0
mov dword [ebp - 0x1540], eax
jmp 0x100dfce4
mov ecx, dword [ebp - 0x14ec]
add ecx, 0x1c
mov dword [ebp - 0x14ec], ecx
mov edx, dword [ebp - 0x14ec]
cmp edx, dword [ebp - 0x1540]
je 0x100dfd8c
mov eax, dword [ebp - 0x14ec]
push eax
lea ecx, [ebp - 0x11ec]
call fcn.10046070
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x11ec]
push ecx
movzx edx, byte [ebp - 0x14f2]
push edx
push 0x10210124
lea ecx, [ebp - 0x1174]
call fcn.100fbc30
mov ecx, eax
call fcn.10092ed0
push eax
lea eax, [ebp - 0x12f8]
push eax
call fcn.100eeb20
add esp, 0xc
mov dword [ebp - 0x1558], eax
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x1560], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1560]
push edx
mov ecx, 0x102ce6b4
call fcn.100ae700
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12f8]
call fcn.10045ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11ec]
call fcn.10045ea0
jmp 0x100dfcd5
lea eax, [ebp - 0x159c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x164], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
lea esi, [ebp - 0x164]
mov eax, connect
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x164]
mov dword [ebp - 0x155c], ecx
push 0x40
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.10157e80
add esp, 0xc
mov dword [ebp - 0x14d8], connect
jmp 0x100dfe11
mov eax, dword [ebp - 0x14d8]
add eax, 1
mov dword [ebp - 0x14d8], eax
mov ecx, dword [ebp - 0x14d8]
cmp ecx, dword [ebp - 0x155c]
ja 0x100dfed7
lea esi, [ebp - 0x164]
mov eax, dword [ebp - 0x14d8]
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14d8], 0x80000002
jne 0x100dfe70
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x44], edx
jmp 0x100dfed2
cmp dword [ebp - 0x14d8], 0x80000003
jne 0x100dfea2
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x34], eax
jmp 0x100dfed2
cmp dword [ebp - 0x14d8], reloc.WS2_32.dll_connect
jne 0x100dfed2
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x24], ecx
jmp 0x100dfe02
mov edx, dword [ebp - 0x1588]
push edx
lea eax, [ebp - 0x1288]
push eax
call fcn.1005b980
add esp, 8
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1550]
mov dword [ebp - 0x1554], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x12a4]
call fcn.10045f80
mov dword [ebp - 0x1544], eax
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1538], eax
mov byte [ebp - 4], 7
movzx ecx, byte [ebp - 0x14f3]
push ecx
push 0x10210168
lea ecx, [ebp - 0x116c]
call fcn.100fbcb0
mov ecx, eax
call fcn.10092ed0
push eax
mov edx, dword [ebp - 0x1538]
push edx
lea eax, [ebp - 0x126c]
push eax
call fcn.100eba50
add esp, 0xc
mov dword [ebp - 0x1548], eax
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x153c], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1554]
push edx
mov eax, dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.100ee290
add esp, 0xc
mov dword [ebp - 0x154c], eax
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0x151c], edx
mov byte [ebp - 4], 9
movzx eax, byte [ebp - 0x14f5]
push eax
push str._Core_s_
lea ecx, [ebp - 0x1230]
call fcn.100fbd30
mov ecx, eax
call fcn.1004fb80
push eax
mov ecx, dword [ebp - 0x151c]
push ecx
lea edx, [ebp - 0x12dc]
push edx
call fcn.100eba50
add esp, 0xc
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x1520]
push eax
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1f0
call fcn.100508b0
lea ecx, [ebp - 0x12dc]
call fcn.10045ea0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12c0]
call fcn.10045ea0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x126c]
call fcn.10045ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x12a4]
call fcn.10045ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1288]
call fcn.10045ea0
push 0x100fba70
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1f0
call fcn.10045c30
push eax
movzx ecx, byte [ebp - 0x14f4]
push ecx
push str._______CPU:
lea ecx, [ebp - 0x1240]
call fcn.10077060
mov ecx, eax
call fcn.1005a020
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100fb750
add esp, 8
push eax
call fcn.100fb750
add esp, 8
mov ecx, eax
call fcn.100e6fa0
mov eax, dword [ebp - 0x14d0]
add eax, 0x1f0
push eax
mov ecx, 0x102ce308
call fcn.10045e30
call fcn.100d16c0
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x1d8], eax
mov dword [ecx + 0x1dc], edx
push 8
call fcn.101551e0
add esp, 4
mov dword [ebp - 0x1508], eax
cmp dword [ebp - 0x1508], 0
je 0x100e00f9
xor edx, edx
mov eax, dword [ebp - 0x1508]
mov dword [eax], edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
jmp 0x100e0103
mov dword [ebp - 0x1510], 0
mov edx, dword [ebp - 0x1510]
mov dword [ebp - 0x1500], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1524], eax
lea eax, [ebp - 0x1184]
push eax
mov ecx, dword [ebp - 0x1524]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x1500]
mov eax, dword [ebp - 0x1178]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x117c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x14d0]
mov ecx, dword [ebp - 0x1500]
mov dword [eax + 0x20c], ecx
lea edx, [ebp - 0x1528]
push edx
push 0x1000
lea eax, [ebp - 0x1164]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100e0350
mov ecx, dword [ebp - 0x1528]
shr ecx, 2
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x14dc], 0
jmp 0x100e01a9
mov edx, dword [ebp - 0x14dc]
add edx, 1
mov dword [ebp - 0x14dc], edx
mov eax, dword [ebp - 0x14dc]
cmp eax, dword [ebp - 0x152c]
jae 0x100e0350
mov ecx, dword [ebp - 0x14dc]
cmp dword [ebp + ecx*4 - 0x1164], 0
je 0x100e034b
mov edx, dword [ebp - 0x14dc]
mov eax, dword [ebp + edx*4 - 0x1164]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0x1504], 0
je 0x100e034b
lea ecx, [ebp - 0x1574]
push ecx
push 4
lea edx, [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100e034b
push 0x104
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea ecx, [ebp - 0x11b4]
call fcn.100e03d0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [ebp - 0x11b4], edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x11b0]
call fcn.10045e10
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [0x10251a58], edx
mov ecx, 0x102ce804
call fcn.100458d0
push 0
push 0x100df590
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x150c], 0x102ce804
mov ecx, dword [ebp - 0x150c]
call fcn.10041f60
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x150c]
call fcn.100458b0
mov dword [ebp - 0x1534], eax
jmp 0x100e02dd
mov eax, dword [ebp - 0x14e8]
add eax, 0x1c
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x14e8]
cmp ecx, dword [ebp - 0x1534]
je 0x100e0324
mov edx, dword [ebp - 0x14e8]
push edx
lea ecx, [ebp - 0x11d0]
call fcn.10046070
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x11d0]
push eax
lea ecx, [ebp - 0x1194]
call fcn.100459c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11d0]
call fcn.10045ea0
jmp 0x100e02ce
lea ecx, [ebp - 0x11b4]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x210
call fcn.100e8360
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11b4]
call fcn.100e0430
jmp 0x100e019a
lea ecx, [ebp - 0x164c]
call fcn.100e6c50
mov edx, dword [ebp - 0x14d0]
add edx, 0x210
push edx
mov ecx, 0x102ce684
call fcn.100e82e0
push 0
push 0
mov eax, dword [ebp - 0x14d0]
push eax
push 0x100d06c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x158], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164c]
call fcn.100e0400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret