Function at 0x1001b89
Capabilities:
Terminate process

Disassembly:
call fcn.010016fb
push 0x5c
push 0x1001ca0
call fcn.010016a9
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x101102c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1003afe
xor esi, esi
inc esi
mov eax, dword [0x1011028]
cmp eax, esi
je 0x1003b1d
mov eax, dword [0x1011028]
test eax, eax
jne 0x1001cd5
mov dword [0x1011028], esi
push 0x1001c98
push 0x1001c8c
call fcn.01002006
pop ecx
pop ecx
test eax, eax
jne 0x1003ba8
mov eax, dword [0x1011028]
cmp eax, esi
jne 0x1001c3c
push 0x1001c88
push 0x1001c80
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1011028], 2
cmp dword [ebp - 0x20], ebx
jne 0x1001c49
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10113d4], ebx
jne 0x1003b2a
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1003ba8
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
jbe 0x1001ebc
cmp ecx, 0x22
je 0x1001cc8
add eax, 2
jmp 0x1001c64
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x1001c78
mov dword [0x1011460], esi
jmp 0x1001c18
cmp cx, bx
je 0x1001eca
cmp dword [ebp - 0x1c], ebx
jne 0x1001c73
movzx ecx, word [eax]
cmp cx, bx
je 0x1001edf
cmp ecx, 0x20
ja 0x1001edf
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x1001eca
test byte [ebp - 0x40], 1
jne 0x1003b4c
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call 0x1001f16
mov dword [0x101101c], eax
cmp dword [0x1011010], ebx
jne 0x1003b85
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1011008], eax
mov dword [0x101100c], eax
call fcn.01002bcf
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
js 0x1001ffa
push esi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.010027f4
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x1001fd7
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1001fd7
xor esi, esi
push dword [esi*8 + 0x1011360]
lea eax, [ebp - 0x210]
push eax
call fcn.01001b46
test eax, eax
jne 0x1001fef
inc esi
cmp esi, 0xc
jb 0x1001fad
cmp esi, 0xc
jae 0x1003909
test ebx, ebx
jns 0x1001f92
call dword [sym.imp.ole32.dll_OleUninitialize]
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 0x10
call dword [esi*8 + 0x1011364]
mov ebx, eax
jmp 0x1001fca
mov ebx, 0x80004005
jmp 0x1001fde
mov ebx, 0x80070057
jmp 0x1001fd3
cmp eax, esi
jne 0x1003b0d
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001bdf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001bcb
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001c18
push 0x10113d4
call fcn.0100cebb
pop ecx
test eax, eax
je 0x1001c55
push ebx
push 2
push ebx
call dword [0x10113d4]
jmp 0x1001c55
movzx ecx, word [ebp - 0x3c]
jmp 0x1001eec
cmp dword [0x1011460], ebx
jne 0x1003b93
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101101c]
jmp 0x1003bb4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010031dc
ret