Function at 0x1001ffd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100838ed
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100ae254]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov edi, dword [ebp + 0xc]
push 0x1008c304
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1d8], esi
call fcn.10007df0
add esp, 4
test edi, edi
je 0x10020056
mov eax, dword [ebp - 0x1e0]
test eax, eax
je 0x10020056
mov ecx, 2
mov word [eax], cx
lea eax, [edi + 2]
push eax
call fcn.1003c880
mov edi, eax
add esp, 4
mov dword [ebp - 0x1d4], edi
mov dword [ebp - 4], esi
test edi, edi
jne 0x10020085
mov dword [ebp - 4], 0xffffffff
push 0x1008c520
call fcn.10007df0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10051ab7
mov esp, ebp
pop ebp
ret 0xc
push 0
mov dword [ebp - 0x188], 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x184], 0
push 0x10089c14
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
call fcn.10011d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
push 4
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
push 0x1008c31c
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
call fcn.10011d00
mov byte [ebp - 4], 2
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x168]
push edi
push eax
call fcn.1003d8f0
add esp, 0x10
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
cmp edx, 0x10
jb 0x1002016b
mov ecx, dword [ebp - 0x180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10020161
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213c6
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x184]
cmp edx, 0x10
jb 0x100201c4
mov ecx, dword [ebp - 0x198]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100201ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213cb
push edx
push ecx
call fcn.10051738
add esp, 8
push 0
mov dword [ebp - 0x1b8], 0
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x1b4], 0
push 0x10089c14
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0xf
mov byte [ebp - 0x1c8], 0
call fcn.10011d00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1b0]
push 7
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
push str.appname
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
call fcn.10011d00
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.1003d8f0
add esp, 0x10
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x19c]
cmp edx, 0x10
jb 0x100202c5
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100202bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213d0
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1b4]
cmp edx, 0x10
jb 0x1002031e
mov ecx, dword [ebp - 0x1c8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10020314
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213d5
push edx
push ecx
call fcn.10051738
add esp, 8
push 0
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10c], 0
push 0x10089c14
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0xf
mov byte [ebp - 0x1c8], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
call fcn.10011d00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x108]
push 7
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
push str.cmdline
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0xf
mov byte [ebp - 0x108], 0
call fcn.10011d00
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x138]
push edi
push eax
call fcn.1003d8f0
add esp, 0x10
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xf4]
cmp edx, 0x10
jb 0x1002041f
mov ecx, dword [ebp - 0x108]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10020415
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213da
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0xf
mov byte [ebp - 0x108], 0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x10c]
cmp edx, 0x10
jb 0x10020478
mov ecx, dword [ebp - 0x120]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002046e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213df
push edx
push ecx
call fcn.10051738
add esp, 8
movaps xmm0, xmmword [0x1008cea0]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
movups xmmword [ebp - 0x1fc], xmm0
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e4], 0
mov byte [ebp - 4], 0x10
lea edi, [ebp - 0x168]
cmp dword [ebp - 0x154], 0x10
cmovae edi, dword [ebp - 0x168]
push edi
mov dword [ebp - 0x1cc], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xfde9
mov dword [ebp - 0x1d0], eax
call edi
mov dword [ebp - 0x1f0], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100afb52
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10051c02
add esp, 8
mov dword [ebp - 0x1fc], eax
test eax, eax
je 0x1002055c
push dword [ebp - 0x1f0]
push eax
push dword [ebp - 0x1d0]
push dword [ebp - 0x1cc]
push 0
push 0xfde9
call edi
mov eax, dword [ebp - 0x1f0]
xor edx, edx
mov ecx, dword [ebp - 0x1fc]
mov word [ecx + eax*2], dx
movaps xmm0, xmmword [0x1008cea0]
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x150]
cmp dword [ebp - 0x13c], 0x10
cmovae eax, dword [ebp - 0x150]
push eax
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
push 0
push 0xfde9
call edi
mov dword [ebp - 0x228], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100afb52
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10051c02
mov edi, eax
add esp, 8
mov dword [ebp - 0x234], edi
test edi, edi
je 0x10020624
push dword [ebp - 0x228]
push edi
push dword [ebp - 0x1d0]
push dword [ebp - 0x1cc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x228]
xor ecx, ecx
mov word [edi + eax*2], cx
movaps xmm0, xmmword [0x1008cea0]
movups xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x200], 0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x124], 0x10
cmovae eax, dword [ebp - 0x138]
push eax
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x20c], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100afb52
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10051c02
add esp, 8
mov dword [ebp - 0x218], eax
test eax, eax
je 0x100206f4
push dword [ebp - 0x20c]
push eax
push dword [ebp - 0x1d0]
push dword [ebp - 0x1cc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20c]
xor edx, edx
mov ecx, dword [ebp - 0x218]
mov word [ecx + eax*2], dx
push str.createprocess
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002090a
mov ecx, dword [0x100af9c0]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1d8], eax
test ecx, ecx
jne 0x10020785
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100af9c0], 0
jne 0x10020774
push 4
call fcn.10051708
add esp, 4
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1002075e
mov ecx, eax
call fcn.10013b80
jmp 0x10020760
xor eax, eax
mov byte [ebp - 4], 0x12
xor edx, edx
lea ecx, [ebp - 0x1dc]
lock or dword [ecx], edx
mov dword [0x100af9c0], eax
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100af9c0]
push edi
call fcn.10013c80
test eax, eax
je 0x100207b4
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp - 0x218]
push edi
call fcn.100164b0
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
call fcn.1003c630
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x14
test esi, esi
jne 0x100207d2
mov byte [ebp - 4], 0x12
jmp 0x10020853
cmp dword [ebp - 0x1d8], 0
je 0x100207e2
call fcn.1003c6e0
jmp 0x100207e7
call fcn.1003c5a0
push eax
push str.result
push esi
call fcn.1003c520
mov eax, dword [ebp - 0x1d0]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008ce90]
movsd qword [esp], xmm0
call fcn.1003c5d0
push eax
push str.processid
push esi
call fcn.1003c520
push esi
call fcn.1003c8e0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x100208b2
mov byte [ebp - 4], 0x12
push esi
call fcn.1003c710
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x218]
call fcn.1001b930
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x234]
call fcn.1001b930
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1fc]
call fcn.1001b930
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.10005870
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.10005870
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10005870
jmp 0x10021390
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + 1]
cmp ecx, 0x1ffe
ja 0x100208e3
mov edx, dword [ebp - 0x1e0]
lea eax, [ecx + 2]
push ecx
push dword [ebp - 0x1d0]
mov word [edx], ax
lea eax, [edx + 2]
push eax
call fcn.100584a0
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.1005e3a2
mov byte [ebp - 4], 0x12
push esi
call fcn.1003c710
add esp, 8
mov dword [ebp - 0x1cc], 0
jmp 0x100211d6
push str.CreateProcessAsSystem
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10020d0b
push 0x40
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push eax
call fcn.10058a20
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x100], xmm0
test edi, edi
je 0x10020c57
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x10020c57
mov ecx, dword [0x100af9c0]
test ecx, ecx
jne 0x100209c0
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100af9c0], 0
jne 0x100209af
push 4
call fcn.10051708
add esp, 4
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x10020999
mov ecx, eax
call fcn.10013b80
jmp 0x1002099b
xor eax, eax
mov byte [ebp - 4], 0x12
xor edx, edx
lea ecx, [ebp - 0x1dc]
lock or dword [ecx], edx
mov dword [0x100af9c0], eax
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100af9c0]
push edi
call fcn.10013c80
test eax, eax
jne 0x10020a48
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x218]
call fcn.1001b930
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x234]
call fcn.1001b930
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1fc]
call fcn.1001b930
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.10005870
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.10005870
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10005870
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1d4]
call fcn.1003c710
add esp, 4
mov dword [ebp - 0x1d4], 0
jmp 0x10020056
push 0x10089d20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1d0], eax
test eax, eax
je 0x10020a86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x1d0]
mov dword [ebp - 0x110], eax
call esi
mov dword [ebp - 0x10c], eax
jmp 0x10020a8c
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x10020aa3
test eax, eax
je 0x10020aa3
lea eax, [ebp - 0x114]
push eax
call ecx
mov byte [ebp - 4], 0x16
push dword [ebp - 0x218]
call fcn.10060289
add esp, 4
mov esi, eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov dword [ebp - 0x1d8], eax
call fcn.1005e3a2
add esp, 4
cmp dword [ebp - 0x1d8], 0
je 0x10020b04
push dword [ebp - 0xfc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x100]
call esi
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1d0], eax
call fcn.1003c630
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x17
test esi, esi
jne 0x10020b2e
mov byte [ebp - 4], 0x16
jmp 0x10020baf
cmp dword [ebp - 0x1d8], 0
je 0x10020b3e
call fcn.1003c6e0
jmp 0x10020b43
call fcn.1003c5a0
push eax
push str.result
push esi
call fcn.1003c520
mov eax, dword [ebp - 0x1d0]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008ce90]
movsd qword [esp], xmm0
call fcn.1003c5d0
push eax
push str.processid
push esi
call fcn.1003c520
push esi
call fcn.1003c8e0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x10020bdb
mov byte [ebp - 4], 0x16
push esi
call fcn.1003c710
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x10020853
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x10020853
push dword [ebp - 0x114]
call eax
jmp 0x10020853
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x1ffe
ja 0x10020c09
mov edx, dword [ebp - 0x1e0]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x1d0]
lea eax, [edx + 2]
mov word [edx], cx
push eax
call fcn.100584a0
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.1005e3a2
mov byte [ebp - 4], 0x16
push esi
call fcn.1003c710
add esp, 8
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x100211d6
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x100211d6
push dword [ebp - 0x114]
call eax
jmp 0x100211d6
mov byte [ebp - 4], 0x11
push dword [ebp - 0x218]
call fcn.1005174f
push 0
mov dword [ebp - 0x218], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x214], 0
call fcn.1005174f
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.1005174f
push 0
mov dword [ebp - 0x234], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x230], 0
call fcn.1005174f
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x1fc]
call fcn.1005174f
push 0
mov dword [ebp - 0x1fc], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x1f8], 0
call fcn.1005174f
add esp, 0x24
mov dword [ebp - 0x1f4], 0
jmp 0x100209f7
push str.SetImmersiveControlPanelAppid
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100210df
movups xmm0, xmmword [str.microsoft.windows.immersivecontrolpanel]
mov ecx, 0x24
lea edi, [ebp - 0xf0]
mov esi, str.windows.immersivecontrolpanel_10.0.1.1000_neutral_neutral_cw5n1h2txyewy
movups xmmword [ebp - 0x60], xmm0
push 0xa
movups xmm0, xmmword [0x1008c3d8]
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x234]
movups xmmword [ebp - 0x50], xmm0
push edi
movups xmm0, xmmword [0x1008c3e8]
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x1008c3f8]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x1008c408]
movups xmmword [ebp - 0x20], xmm0
call fcn.100601fe
add esp, 0xc
mov dword [ebp - 0x1dc], eax
test eax, eax
je 0x100209ca
mov esi, dword [str.8FA908C0_EAC5_47F9_8074_FFC5EBBEB255]
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x100213e4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1cc]
push esi
call fcn.10007a50
test al, al
jne 0x10020def
test esi, esi
jne 0x10020dce
xor ecx, ecx
jmp 0x10020de2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020dd3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x1cc]
call fcn.10010000
mov byte [ebp - 4], 0x19
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x100213ee
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1d8], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1d8]
push str.LREXJzUYfYA
call fcn.10007a50
test al, al
jne 0x10020e3c
push 0xc
push str.LREXJzUYfYA
lea ecx, [ebp - 0x1d8]
call fcn.10010000
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.10031d40
add esp, 0xc
mov byte [ebp - 4], 0x1c
mov edx, dword [eax]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 7
lea esi, [ecx + 2]
mov word [ebp - 0x108], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020ea0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x108]
call fcn.10011df0
mov byte [ebp - 4], 0x1e
or esi, 0xffffffff
mov edx, dword [ebp - 0x1d0]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10020ee0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x20
mov eax, esi
mov edx, dword [ebp - 0x1d8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10020f01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x1cc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10020f20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xf4], 8
lea eax, [ebp - 0x108]
cmovae eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
push dword [ebp - 0x1dc]
call fcn.1001aed0
xor ecx, ecx
add esp, 0x10
test eax, eax
setns cl
mov dword [ebp - 0x1d8], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1dc], eax
call fcn.1003c630
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x24
test esi, esi
jne 0x10020f94
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x108]
call fcn.100058f0
jmp 0x10020853
cmp dword [ebp - 0x1d8], 0
je 0x10020fa4
call fcn.1003c6e0
jmp 0x10020fa9
call fcn.1003c5a0
push eax
push str.result
push esi
call fcn.1003c520
mov eax, dword [ebp - 0x1dc]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008ce90]
movsd qword [esp], xmm0
call fcn.1003c5d0
push eax
push str.processid
push esi
call fcn.1003c520
push esi
call fcn.1003c8e0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x10021029
mov byte [ebp - 4], 0x22
push esi
call fcn.1003c710
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x108]
call fcn.100058f0
jmp 0x10020853
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x1ffe
ja 0x10021057
mov edx, dword [ebp - 0x1e0]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x1d0]
lea eax, [edx + 2]
mov word [edx], cx
push eax
call fcn.100584a0
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.1005e3a2
mov byte [ebp - 4], 0x22
push esi
call fcn.1003c710
add esp, 8
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0xf4]
cmp edx, 8
jb 0x100210bd
mov ecx, dword [ebp - 0x108]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100210b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213f8
push edx
push ecx
call fcn.10051738
add esp, 8
xor eax, eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 7
mov word [ebp - 0x108], ax
jmp 0x100211d6
push str.LoadLibraryEx
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100211d6
push edi
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x100211b4
push edi
call fcn.1001ce70
add esp, 4
test eax, eax
je 0x100211b4
lea ecx, [ebp - 0x114]
call fcn.1001b540
mov byte [ebp - 4], 0x25
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1cc], eax
test eax, eax
je 0x10021195
cmp dword [ebp - 0x128], 0
jne 0x1002115d
push 0x17
push str.LoadLibraryExThreadProc
lea ecx, [ebp - 0x138]
call fcn.10011d00
cmp dword [ebp - 0x124], 0x10
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
push eax
push dword [ebp - 0x1cc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10021195
push dword [ebp - 0x1e0]
call eax
mov esi, 1
mov dword [ebp - 0x1d8], esi
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x100211b4
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x100211b4
push dword [ebp - 0x114]
call eax
push dword [ebp - 0x1cc]
push str.ModuleHandle
push dword [ebp - 0x1e0]
push esi
call fcn.1001f380
add esp, 0x10
test eax, eax
je 0x10020853
mov byte [ebp - 4], 0x11
push dword [ebp - 0x218]
call fcn.1005174f
push 0
mov dword [ebp - 0x218], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x214], 0
call fcn.1005174f
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.1005174f
push 0
mov dword [ebp - 0x234], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x230], 0
call fcn.1005174f
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x1fc]
call fcn.1005174f
push 0
mov dword [ebp - 0x1fc], 0
call fcn.1005174f
push 0
mov dword [ebp - 0x1f8], 0
call fcn.1005174f
add esp, 0x24
mov dword [ebp - 0x1f4], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x100212c3
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100212b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100213fd
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x13c]
cmp edx, 0x10
jb 0x1002131c
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10021312
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10021402
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x154]
cmp edx, 0x10
jb 0x10021375
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002136b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10021407
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1d4]
call fcn.1003c710
add esp, 4
mov dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d8], 0
je 0x10020056
push 0x1008c508
jmp 0x1002005b
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
push 0x80004005
call fcn.10007a30
push 0x80004005
call fcn.10007a30
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
call fcn.1005bb49
int3