Function at 0x100dfb50
Capabilities:
Create directory
Create thread
Enumerate gui resources
Enumerate process modules
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b8ee9
mov eax, dword fs:[0]
push eax
mov eax, 0x1640
call fcn.1015b2a0
mov eax, dword [0x10247db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14d0], ecx
push 0x100dfab0
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call fcn.100020f0
mov dword [0x10266c04], eax
cmp dword [0x10266c4c], 0
jne 0x100dfbb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10266c4c], eax
cmp dword [0x10266bc8], 0
jne 0x100dfbd4
push 0
push 4
push 0x10266bc8
push 0xf3e860
mov ecx, dword [0x10266c4c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 1
lea ecx, [ebp - 0x164c]
call fcn.100e7110
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0x14ed]
push edx
push 0x1020c1d4
lea ecx, [ebp - 0x1568]
call fcn.100fb490
mov ecx, eax
call fcn.1007ade0
push eax
lea ecx, [ebp - 0x1224]
call fcn.100451a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1224]
push eax
call fcn.100d1640
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100dfc39
mov dword [ebp - 0x1518], 1
jmp 0x100dfc43
mov dword [ebp - 0x1518], 0
mov dl, byte [ebp - 0x1518]
mov byte [ebp - 0x14d1], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1224]
call fcn.100450b0
movzx eax, byte [ebp - 0x14d1]
test eax, eax
je 0x100dfc91
push 0
movzx ecx, byte [ebp - 0x14ee]
push ecx
push 0x1020c238
lea ecx, [ebp - 0x1564]
call fcn.100fb4d0
mov ecx, eax
call fcn.1007ade0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40
push 2
movzx edx, byte [ebp - 0x14ef]
push edx
push str.init_log.txt
lea ecx, [ebp - 0x1308]
call fcn.1005bcb0
mov ecx, eax
call fcn.1005a500
push eax
lea ecx, [ebp - 0x164c]
call fcn.100e7050
push 0x101f1936
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1a0
call fcn.10045050
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1d0], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1d1], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1dd], 0
mov eax, dword [ebp - 0x14d0]
mov dword [eax + 0x1cc], 0
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x1c0], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1d2], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1d3], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1d4], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1d5], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1d6], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1d7], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1db], 0
mov eax, dword [ebp - 0x14d0]
mov byte [eax + 0x1d8], 0
mov ecx, dword [ebp - 0x14d0]
mov byte [ecx + 0x1d9], 0
mov edx, dword [ebp - 0x14d0]
mov byte [edx + 0x1dc], 0
xor eax, eax
mov ecx, dword [ebp - 0x14d0]
mov word [ecx + 0x22c], ax
mov edx, dword [ebp - 0x14d0]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x230], eax
mov dword [edx + 0x234], ecx
push 0
push 1
mov edx, dword [ebp - 0x14d0]
add edx, 0x1dd
push edx
mov eax, dword [0x10266bc8]
add eax, 0xce8
push eax
mov ecx, dword [0x10266c4c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x14d0]
mov dword [edx + 0x1bc], 1
xor eax, eax
mov word [ebp - 0x14e0], ax
lea ecx, [ebp - 0x14e0]
push ecx
lea edx, [ebp - 0x14fc]
push edx
call fcn.100d1790
add esp, 8
movzx eax, word [ebp - 0x14fc]
movzx ecx, word [ebp - 0x14e0]
add eax, ecx
mov edx, dword [ebp - 0x14d0]
mov dword [edx + 0x228], eax
mov dword [ebp - 0x14cc], 0x1a8
mov dword [ebp - 0x14e4], 0
push 0x100fbb40
movzx eax, byte [ebp - 0x14f0]
push eax
push str.___HSACSX_Initializing___
lea ecx, [ebp - 0x1324]
call fcn.100fb510
mov ecx, eax
call fcn.100cc0c0
push eax
lea ecx, [ebp - 0x164c]
push ecx
call fcn.100fb820
add esp, 8
mov ecx, eax
call fcn.100e7370
push 0
lea edx, [ebp - 0x14cc]
push edx
mov eax, dword [ebp - 0x14e4]
push eax
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x100dffb1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x156c], esp
lea edx, [ebp - 0x14a8]
push edx
call fcn.100451a0
mov dword [ebp - 0x1570], eax
mov byte [ebp - 4], 2
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1578], esp
mov eax, dword [ebp - 0x14d0]
add eax, 0x1e8
push eax
call fcn.100e8dd0
mov byte [ebp - 4], 0
call fcn.100df9b0
add esp, 0x2c
mov byte [ebp - 0x14d2], al
movzx ecx, byte [ebp - 0x14d2]
test ecx, ecx
je 0x100dff15
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
jmp 0x100dfe87
lea eax, [ebp - 0x14a8]
push eax
lea ecx, [ebp - 0x1208]
call fcn.100451a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1208]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1e8
call fcn.100449f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1208]
call fcn.100450b0
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
push 0x100fbb40
lea eax, [ebp - 0x14a8]
push eax
movzx ecx, byte [ebp - 0x14f1]
push ecx
push str._______GPU:
lea ecx, [ebp - 0x1250]
call fcn.100fbb70
mov ecx, eax
call fcn.10071980
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100fb820
add esp, 8
push eax
call fcn.100fb820
add esp, 8
mov ecx, eax
call fcn.100e7370
jmp 0x100dfe87
push 0x101f1937
mov ecx, 0x102e1b44
call fcn.10045050
mov eax, dword [ebp - 0x14d0]
add eax, 0x1e8
mov dword [ebp - 0x1514], eax
mov ecx, dword [ebp - 0x1514]
call fcn.10040f80
mov dword [ebp - 0x14ec], eax
mov ecx, dword [ebp - 0x1514]
call fcn.10044910
mov dword [ebp - 0x1540], eax
jmp 0x100e0004
mov ecx, dword [ebp - 0x14ec]
add ecx, 0x1c
mov dword [ebp - 0x14ec], ecx
mov edx, dword [ebp - 0x14ec]
cmp edx, dword [ebp - 0x1540]
je 0x100e00ac
mov eax, dword [ebp - 0x14ec]
push eax
lea ecx, [ebp - 0x11ec]
call fcn.10045370
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x11ec]
push ecx
movzx edx, byte [ebp - 0x14f2]
push edx
push 0x1020c248
lea ecx, [ebp - 0x1174]
call fcn.100fbd00
mov ecx, eax
call fcn.10079a30
push eax
lea eax, [ebp - 0x12f8]
push eax
call fcn.100efe30
add esp, 0xc
mov dword [ebp - 0x1558], eax
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x1560], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1560]
push edx
mov ecx, 0x102e1b44
call fcn.100ab3f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12f8]
call fcn.100450b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11ec]
call fcn.100450b0
jmp 0x100dfff5
lea eax, [ebp - 0x159c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x164], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
lea esi, [ebp - 0x164]
mov eax, connect
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x164]
mov dword [ebp - 0x155c], ecx
push 0x40
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.1015cb20
add esp, 0xc
mov dword [ebp - 0x14d8], connect
jmp 0x100e0131
mov eax, dword [ebp - 0x14d8]
add eax, 1
mov dword [ebp - 0x14d8], eax
mov ecx, dword [ebp - 0x14d8]
cmp ecx, dword [ebp - 0x155c]
ja 0x100e01f7
lea esi, [ebp - 0x164]
mov eax, dword [ebp - 0x14d8]
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14d8], 0x80000002
jne 0x100e0190
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x44], edx
jmp 0x100e01f2
cmp dword [ebp - 0x14d8], 0x80000003
jne 0x100e01c2
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x34], eax
jmp 0x100e01f2
cmp dword [ebp - 0x14d8], reloc.WS2_32.dll_connect
jne 0x100e01f2
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x24], ecx
jmp 0x100e0122
mov edx, dword [ebp - 0x1588]
push edx
lea eax, [ebp - 0x1288]
push eax
call fcn.100584f0
add esp, 8
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1550]
mov dword [ebp - 0x1554], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x12a4]
call fcn.100451a0
mov dword [ebp - 0x1544], eax
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1538], eax
mov byte [ebp - 4], 7
movzx ecx, byte [ebp - 0x14f3]
push ecx
push 0x1020c278
lea ecx, [ebp - 0x116c]
call fcn.100fbd80
mov ecx, eax
call fcn.10079a30
push eax
mov edx, dword [ebp - 0x1538]
push edx
lea eax, [ebp - 0x126c]
push eax
call fcn.100ec5a0
add esp, 0xc
mov dword [ebp - 0x1548], eax
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x153c], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1554]
push edx
mov eax, dword [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.100eede0
add esp, 0xc
mov dword [ebp - 0x154c], eax
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0x151c], edx
mov byte [ebp - 4], 9
movzx eax, byte [ebp - 0x14f5]
push eax
push str._Core_s_
lea ecx, [ebp - 0x1230]
call fcn.100fbe00
mov ecx, eax
call fcn.1004dd90
push eax
mov ecx, dword [ebp - 0x151c]
push ecx
lea edx, [ebp - 0x12dc]
push edx
call fcn.100ec5a0
add esp, 0xc
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x1520]
push eax
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1f8
call fcn.1004eac0
lea ecx, [ebp - 0x12dc]
call fcn.100450b0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12c0]
call fcn.100450b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x126c]
call fcn.100450b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x12a4]
call fcn.100450b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1288]
call fcn.100450b0
push 0x100fbb40
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x1f8
call fcn.10044e70
push eax
movzx ecx, byte [ebp - 0x14f4]
push ecx
push str._______CPU:
lea ecx, [ebp - 0x1240]
call fcn.100fbf10
mov ecx, eax
call fcn.10071980
push eax
lea edx, [ebp - 0x164c]
push edx
call fcn.100fb820
add esp, 8
push eax
call fcn.100fb820
add esp, 8
mov ecx, eax
call fcn.100e7370
mov eax, dword [ebp - 0x14d0]
add eax, 0x1f8
push eax
mov ecx, 0x102e18bc
call fcn.10045070
call fcn.100d1680
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x1e0], eax
mov dword [ecx + 0x1e4], edx
push 8
call fcn.10159ea0
add esp, 4
mov dword [ebp - 0x1508], eax
cmp dword [ebp - 0x1508], 0
je 0x100e0419
xor edx, edx
mov eax, dword [ebp - 0x1508]
mov dword [eax], edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
jmp 0x100e0423
mov dword [ebp - 0x1510], 0
mov edx, dword [ebp - 0x1510]
mov dword [ebp - 0x1500], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1524], eax
lea eax, [ebp - 0x1184]
push eax
mov ecx, dword [ebp - 0x1524]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x1500]
mov eax, dword [ebp - 0x1178]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x117c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x14d0]
mov ecx, dword [ebp - 0x1500]
mov dword [eax + 0x214], ecx
lea edx, [ebp - 0x1528]
push edx
push 0x1000
lea eax, [ebp - 0x1164]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100e0670
mov ecx, dword [ebp - 0x1528]
shr ecx, 2
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x14dc], 0
jmp 0x100e04c9
mov edx, dword [ebp - 0x14dc]
add edx, 1
mov dword [ebp - 0x14dc], edx
mov eax, dword [ebp - 0x14dc]
cmp eax, dword [ebp - 0x152c]
jae 0x100e0670
mov ecx, dword [ebp - 0x14dc]
cmp dword [ebp + ecx*4 - 0x1164], 0
je 0x100e066b
mov edx, dword [ebp - 0x14dc]
mov eax, dword [ebp + edx*4 - 0x1164]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0x1504], 0
je 0x100e066b
lea ecx, [ebp - 0x1574]
push ecx
push 4
lea edx, [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100e066b
push 0x104
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x1530]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea ecx, [ebp - 0x11b4]
call fcn.100e06f0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [ebp - 0x11b4], edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x11b0]
call fcn.10045050
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [0x10266b44], edx
mov ecx, 0x102e1b34
call fcn.10044930
push 0
push 0x100df8b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x150c], 0x102e1b34
mov ecx, dword [ebp - 0x150c]
call fcn.10040f80
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x150c]
call fcn.10044910
mov dword [ebp - 0x1534], eax
jmp 0x100e05fd
mov eax, dword [ebp - 0x14e8]
add eax, 0x1c
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x14e8]
cmp ecx, dword [ebp - 0x1534]
je 0x100e0644
mov edx, dword [ebp - 0x14e8]
push edx
lea ecx, [ebp - 0x11d0]
call fcn.10045370
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x11d0]
push eax
lea ecx, [ebp - 0x1194]
call fcn.10044b00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11d0]
call fcn.100450b0
jmp 0x100e05ee
lea ecx, [ebp - 0x11b4]
push ecx
mov ecx, dword [ebp - 0x14d0]
add ecx, 0x218
call fcn.100e8b90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11b4]
call fcn.100e0750
jmp 0x100e04ba
lea ecx, [ebp - 0x164c]
call fcn.100e7020
mov edx, dword [ebp - 0x14d0]
add edx, 0x218
push edx
mov ecx, 0x102e19d0
call fcn.100e8b50
push 0
push 0
mov eax, dword [ebp - 0x14d0]
push eax
push 0x100d0690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx + 0x158], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164c]
call fcn.100e0720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10159b70
mov esp, ebp
pop ebp
ret