Function at 0x1001bab
Capabilities:
Create thread
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
or dword [ebp - 0x10c], 0xffffffff
mov esi, 0x10011bc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0xcc], eax
xor eax, eax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 1
push ebx
mov dword [ebp - 0xd0], 0x258
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp eax, ebx
je 0x1001c6d
push 0xa
lea ecx, [ebp - 0x2e]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__ultow]
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wsetlocale]
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
mov eax, dword [ebp - 0xcc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, 0x12e
push edi
push 0x10046e8
mov dword [0x1004690], eax
call fcn.0100184e
test eax, eax
je 0x1002426
push 0x12f
push 0x10040f0
call fcn.0100184e
test eax, eax
je 0x1002426
dec dword [ebp + 8]
add dword [ebp - 0xcc], 4
lea eax, [ebp - 0xdc]
push eax
push 0x12d
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0100165d
test eax, eax
je 0x1001d9f
lea eax, [ebp - 0xd0]
push eax
push 0x131
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.01001719
test eax, eax
je 0x1001d9f
lea eax, [ebp - 0xe4]
push eax
push 0x132
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.010015d5
test eax, eax
je 0x1001d9f
lea eax, [ebp - 0x100]
push eax
push 0x133
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.010015d5
test eax, eax
je 0x1001d9f
lea eax, [ebp - 0xf4]
push eax
push 0x134
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.010015d5
test eax, eax
je 0x1001d9f
lea eax, [ebp - 0xec]
push eax
push 0x135
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.010015d5
test eax, eax
je 0x1001d9f
cmp dword [ebp + 8], ebx
jne 0x1001d9f
xor esi, esi
inc esi
jmp 0x1001da1
xor esi, esi
mov dword [ebp - 0xcc], ebx
cmp esi, ebx
je 0x1001e12
cmp dword [ebp - 0xdc], ebx
jne 0x1001dbf
mov dword [ebp - 0xcc], 3
jmp 0x1001dfd
push 0x12f
push dword [ebp - 0xdc]
call fcn.010017e5
test eax, eax
je 0x1001ddf
mov dword [ebp - 0xcc], 1
jmp 0x1001dfd
push edi
push dword [ebp - 0xdc]
call fcn.010017e5
test eax, eax
je 0x1001dfb
mov dword [ebp - 0xcc], 2
jmp 0x1001dfd
xor esi, esi
cmp esi, ebx
je 0x1001e12
xor eax, eax
cmp dword [ebp - 0xe4], ebx
setne al
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd0]
cmp eax, 0xffffffff
jne 0x1001e25
or dword [ebp - 0xdc], eax
jmp 0x1001e2b
mov dword [ebp - 0xdc], eax
cmp esi, ebx
jne 0x1001e39
call fcn.01001a41
jmp 0x10023e4
cmp dword [ebp - 0xf4], ebx
je 0x1001e4b
mov dword [ebp - 0x100], 1
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xec], ebx
je 0x1001f28
mov esi, dword [sym.imp.USERENV.dll_ForceSyncFgPolicy]
and eax, 1
mov dword [ebp - 0xe4], eax
je 0x1001ea0
push ebx
call esi
cmp eax, ebx
je 0x1001ea0
cmp eax, 5
jne 0x1001e84
push 0xe6
jmp 0x10023de
push 0x1004280
push eax
call fcn.01001879
push eax
push 0xde
call fcn.010019d3
pop ecx
jmp 0x10023e3
mov eax, dword [ebp - 0xcc]
and eax, 2
mov dword [ebp - 0xcc], eax
je 0x10021d9
lea eax, [ebp - 0xd8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001edc
push 0x1004280
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001e89
push dword [ebp - 0xd8]
call fcn.01002504
mov edi, eax
cmp edi, ebx
je 0x1001ecf
push edi
call esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
je 0x1001f11
cmp esi, 5
je 0x1001e7a
push 0x1004280
push esi
jmp 0x1001e8a
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xd8], ebx
jmp 0x10021d9
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
and eax, 1
mov dword [ebp - 0xe4], eax
mov edi, 0x10018aa
je 0x1001f9a
mov eax, dword [ebp - 0xd4]
push ebx
push ebx
push 0x10046bc
push edi
mov dword [0x10046c0], eax
mov eax, dword [ebp - 0xdc]
push ebx
push ebx
mov dword [0x10046bc], 1
mov dword [0x10046c4], eax
call esi
mov dword [ebp - 0x108], eax
cmp eax, ebx
jne 0x1001f90
push 0x1004280
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01001879
push eax
push 0xd4
jmp 0x1001e95
mov dword [ebp - 0xe0], 1
mov eax, dword [ebp - 0xcc]
and eax, 2
mov dword [ebp - 0xcc], eax
je 0x1001fea
mov eax, dword [ebp - 0xd4]
push ebx
push ebx
push 0x1004694
push edi
mov dword [0x1004698], eax
mov eax, dword [ebp - 0xdc]
push ebx
push ebx
mov dword [0x1004694], ebx
mov dword [0x100469c], eax
call esi
mov ecx, dword [ebp - 0xe0]
mov dword [ebp + ecx*4 - 0x108], eax
cmp eax, ebx
je 0x1001f74
inc dword [ebp - 0xe0]
push 0xc9
call fcn.010019d3
pop ecx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, ebx
je 0x1002019
cmp eax, 1
jne 0x1001f74
cmp dword [ebp - 0xcc], ebx
je 0x10020e6
sub esp, 0x10
mov edi, esp
mov esi, 0x10046ac
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [ebp - 0xc8]
movsd dword es:[edi], dword [esi]
call fcn.01002546
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xd4], ebx
call fcn.01002601
cmp eax, ebx
jne 0x10020bf
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.01002911
cmp eax, ebx
jne 0x10020bf
cmp dword [ebp - 0xd0], ebx
jne 0x10020b3
cmp dword [ebp - 0xd4], ebx
je 0x10020bf
push 0x1004694
mov dword [ebp - 0xfc], 1
call fcn.01001b25
push 0xdd
call fcn.010019d3
pop ecx
lea ecx, [ebp - 0xc8]
call fcn.0100262f
jmp 0x10020c9
mov dword [ebp - 0xe8], 1
jmp 0x10020a6
push 0x1004694
call fcn.01001b25
cmp dword [0x10046a4], ebx
je 0x10020db
mov dword [ebp - 0xe8], 1
lea ecx, [ebp - 0xc8]
call fcn.0100259c
cmp dword [ebp - 0xe4], ebx
je 0x10021b4
sub esp, 0x10
mov edi, esp
mov esi, 0x10046d4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea ecx, [ebp - 0xc8]
movsd dword es:[edi], dword [esi]
call fcn.01002546
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xd4], ebx
call fcn.01002601
cmp eax, ebx
jne 0x100218d
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.01002911
cmp eax, ebx
jne 0x100218d
cmp dword [ebp - 0xd0], ebx
jne 0x1002181
cmp dword [ebp - 0xd4], ebx
je 0x100218d
push 0x10046bc
mov dword [ebp - 0xfc], 1
call fcn.01001b25
push 0xdd
call fcn.010019d3
pop ecx
lea ecx, [ebp - 0xc8]
call fcn.0100262f
jmp 0x1002197
mov dword [ebp - 0xe8], 1
jmp 0x1002174
push 0x10046bc
call fcn.01001b25
cmp dword [0x10046cc], ebx
je 0x10021a9
mov dword [ebp - 0xe8], 1
lea ecx, [ebp - 0xc8]
call fcn.0100259c
cmp dword [ebp - 0xe8], ebx
je 0x10021c6
push 0xe1
jmp 0x10023de
cmp dword [ebp - 0xfc], ebx
je 0x10021d9
push 0xe7
call fcn.010019d3
pop ecx
mov edi, 0xdd
push edi
call fcn.010019d3
pop ecx
cmp dword [ebp - 0xcc], ebx
je 0x100221a
cmp dword [ebp - 0xec], ebx
jne 0x1002213
cmp dword [0x10046a8], ebx
je 0x100221a
push 0xce
call fcn.010019d3
xor esi, esi
inc esi
pop ecx
mov dword [ebp - 0xf8], esi
jmp 0x100221d
push 0xdf
jmp 0x1002202
xor esi, esi
inc esi
cmp dword [ebp - 0xe4], ebx
je 0x100224a
cmp dword [ebp - 0xec], ebx
jne 0x10022c3
cmp dword [0x10046d0], ebx
je 0x100224a
push 0xcf
call fcn.010019d3
pop ecx
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x10c], ebx
cmp dword [ebp - 0xf0], ebx
jne 0x1002264
cmp dword [ebp - 0xf8], ebx
je 0x10023e4
push edi
call fcn.010019d3
pop ecx
cmp dword [ebp - 0xf0], ebx
je 0x100238c
cmp dword [ebp - 0xf4], ebx
jne 0x100228d
push esi
call fcn.01001a5e
cmp eax, ebx
je 0x100238c
lea eax, [ebp - 0xd8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10022cd
push 0x1004280
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01001879
push eax
push 0xd5
jmp 0x1001e95
push 0xe0
jmp 0x100223e
lea eax, [ebp - 0x10]
push eax
push 0x1001194
push ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10022a7
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10022a7
push 0xd7
call fcn.010019d3
pop ecx
push 0x80020004
push esi
push ebx
push 0x1e
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xd5
test eax, eax
jne 0x1002355
push 0x1004280
call esi
push eax
call fcn.01001879
push eax
push edi
call fcn.010019d3
pop ecx
jmp 0x100235f
push 0xd9
call fcn.010019d3
pop ecx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10023e4
push 0x1004280
call esi
push eax
call fcn.01001879
push eax
push edi
jmp 0x1001e95
cmp dword [ebp - 0xf8], ebx
je 0x10023e4
cmp dword [ebp - 0x100], ebx
jne 0x10023a6
push ebx
call fcn.01001a5e
cmp eax, ebx
je 0x10023e4
push 0xd8
call fcn.010019d3
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10023d9
push 0x1004280
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01001879
push eax
push 0xd6
jmp 0x1001e95
push 0xda
call fcn.010019d3
pop ecx
cmp dword [ebp - 0xd8], ebx
je 0x10023f8
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xe0]
cmp edi, ebx
je 0x100241e
lea esi, [ebp + edi*4 - 0x10c]
mov eax, dword [esi]
cmp eax, ebx
je 0x1002416
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec edi
sub esi, 4
cmp edi, ebx
jne 0x1002409
mov eax, dword [ebp - 0x10c]
jmp 0x1002429
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002c19
leave
ret