Function at 0x100d9290
Capabilities:
Create directory
Create thread
Enumerate gui resources
Enumerate process modules
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1fc9
mov eax, dword fs:[0]
push eax
mov eax, 0x1648
call fcn.10155950
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14d8], ecx
push 0x100d91f0
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call fcn.100020f0
mov dword [0x1024c960], eax
cmp dword [0x1024c9a4], 0
jne 0x100d92f0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1024c9a4], eax
cmp dword [0x1024c928], 0
jne 0x100d9314
push 0
push 4
push 0x1024c928
push 0xf3e860
mov ecx, dword [0x1024c9a4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 1
lea ecx, [ebp - 0x1654]
call fcn.100e0700
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0x14f5]
push edx
push 0x10205c3c
lea ecx, [ebp - 0x1570]
call fcn.100f6f60
mov ecx, eax
call fcn.100c9980
push eax
lea ecx, [ebp - 0x11d0]
call fcn.100450b0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x11d0]
push eax
call fcn.100cb080
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100d9379
mov dword [ebp - 0x1520], 1
jmp 0x100d9383
mov dword [ebp - 0x1520], 0
mov dl, byte [ebp - 0x1520]
mov byte [ebp - 0x14d9], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11d0]
call fcn.10044fc0
movzx eax, byte [ebp - 0x14d9]
test eax, eax
je 0x100d93d1
push 0
movzx ecx, byte [ebp - 0x14f6]
push ecx
push 0x10205c38
lea ecx, [ebp - 0x156c]
call fcn.100f6fa0
mov ecx, eax
call fcn.100c9980
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40
push 2
movzx edx, byte [ebp - 0x14f7]
push edx
push str.init_log.txt
lea ecx, [ebp - 0x1308]
call fcn.100f6fe0
mov ecx, eax
call fcn.100597b0
push eax
lea ecx, [ebp - 0x1654]
call fcn.100e0640
push 0x101e9b9e
mov ecx, dword [ebp - 0x14d8]
add ecx, 0x198
call fcn.10044f60
mov eax, dword [ebp - 0x14d8]
mov byte [eax + 0x1c8], 0
mov ecx, dword [ebp - 0x14d8]
mov byte [ecx + 0x1c9], 0
mov edx, dword [ebp - 0x14d8]
mov byte [edx + 0x1d5], 0
mov eax, dword [ebp - 0x14d8]
mov dword [eax + 0x1c4], 0
mov ecx, dword [ebp - 0x14d8]
mov dword [ecx + 0x1b8], 0
mov edx, dword [ebp - 0x14d8]
mov byte [edx + 0x1ca], 0
mov eax, dword [ebp - 0x14d8]
mov byte [eax + 0x1cb], 0
mov ecx, dword [ebp - 0x14d8]
mov byte [ecx + 0x1cc], 0
mov edx, dword [ebp - 0x14d8]
mov byte [edx + 0x1cd], 0
mov eax, dword [ebp - 0x14d8]
mov byte [eax + 0x1ce], 0
mov ecx, dword [ebp - 0x14d8]
mov byte [ecx + 0x1cf], 0
mov edx, dword [ebp - 0x14d8]
mov byte [edx + 0x1d3], 0
mov eax, dword [ebp - 0x14d8]
mov byte [eax + 0x1d0], 0
mov ecx, dword [ebp - 0x14d8]
mov byte [ecx + 0x1d1], 0
mov edx, dword [ebp - 0x14d8]
mov byte [edx + 0x1d4], 0
xor eax, eax
mov ecx, dword [ebp - 0x14d8]
mov word [ecx + 0x224], ax
mov edx, dword [ebp - 0x14d8]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x228], eax
mov dword [edx + 0x22c], ecx
push 0
push 1
mov edx, dword [ebp - 0x14d8]
add edx, 0x1d5
push edx
mov eax, dword [0x1024c928]
add eax, 0xce8
push eax
mov ecx, dword [0x1024c9a4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x14d8]
mov dword [edx + 0x1b4], 1
xor eax, eax
mov word [ebp - 0x14e8], ax
lea ecx, [ebp - 0x14e8]
push ecx
lea edx, [ebp - 0x1504]
push edx
call fcn.100cb1d0
add esp, 8
movzx eax, word [ebp - 0x1504]
movzx ecx, word [ebp - 0x14e8]
add eax, ecx
mov edx, dword [ebp - 0x14d8]
mov dword [edx + 0x220], eax
mov dword [ebp - 0x14d4], 0x1a8
mov dword [ebp - 0x14ec], 0
push 0x100f7890
movzx eax, byte [ebp - 0x14f8]
push eax
push str.___BaseWarOnline_Initializing___
lea ecx, [ebp - 0x132c]
call fcn.100f7190
mov ecx, eax
call fcn.100d4be0
push eax
lea ecx, [ebp - 0x1654]
push ecx
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
push 0
lea edx, [ebp - 0x14d4]
push edx
mov eax, dword [ebp - 0x14ec]
push eax
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x100d96f1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1574], esp
lea edx, [ebp - 0x14b0]
push edx
call fcn.100450b0
mov dword [ebp - 0x1578], eax
mov byte [ebp - 4], 2
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1580], esp
mov eax, dword [ebp - 0x14d8]
add eax, 0x1e0
push eax
call fcn.100e22d0
mov byte [ebp - 4], 0
call fcn.100d90f0
add esp, 0x2c
mov byte [ebp - 0x14da], al
movzx ecx, byte [ebp - 0x14da]
test ecx, ecx
je 0x100d9655
mov edx, dword [ebp - 0x14ec]
add edx, 1
mov dword [ebp - 0x14ec], edx
jmp 0x100d95c7
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x1224]
call fcn.100450b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1224]
push ecx
mov ecx, dword [ebp - 0x14d8]
add ecx, 0x1e0
call fcn.10044900
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1224]
call fcn.10044fc0
mov edx, dword [ebp - 0x14ec]
add edx, 1
mov dword [ebp - 0x14ec], edx
push 0x100f7890
lea eax, [ebp - 0x14b0]
push eax
movzx ecx, byte [ebp - 0x14f9]
push ecx
push str._______GPU:
lea ecx, [ebp - 0x1250]
call fcn.1009bdb0
mov ecx, eax
call fcn.10072490
push eax
lea edx, [ebp - 0x1654]
push edx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
jmp 0x100d95c7
push 0x101e9b9b
mov ecx, 0x102c7924
call fcn.10044f60
mov eax, dword [ebp - 0x14d8]
add eax, 0x1e0
mov dword [ebp - 0x151c], eax
mov ecx, dword [ebp - 0x151c]
call fcn.10040fe0
mov dword [ebp - 0x14f4], eax
mov ecx, dword [ebp - 0x151c]
call fcn.10044820
mov dword [ebp - 0x1548], eax
jmp 0x100d9744
mov ecx, dword [ebp - 0x14f4]
add ecx, 0x1c
mov dword [ebp - 0x14f4], ecx
mov edx, dword [ebp - 0x14f4]
cmp edx, dword [ebp - 0x1548]
je 0x100d97ec
mov eax, dword [ebp - 0x14f4]
push eax
lea ecx, [ebp - 0x1208]
call fcn.10045280
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1208]
push ecx
movzx edx, byte [ebp - 0x14fa]
push edx
push 0x10205ca0
lea ecx, [ebp - 0x1174]
call fcn.100f78c0
mov ecx, eax
call fcn.10090ee0
push eax
lea eax, [ebp - 0x12f8]
push eax
call fcn.100e8a80
add esp, 0xc
mov dword [ebp - 0x1560], eax
mov ecx, dword [ebp - 0x1560]
mov dword [ebp - 0x1568], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1568]
push edx
mov ecx, 0x102c7924
call fcn.100a9ba0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12f8]
call fcn.10044fc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1208]
call fcn.10044fc0
jmp 0x100d9735
lea eax, [ebp - 0x15a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x164], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
lea esi, [ebp - 0x164]
mov eax, connect
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x164]
mov dword [ebp - 0x1564], ecx
push 0x40
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.101571d0
add esp, 0xc
mov dword [ebp - 0x14e0], connect
jmp 0x100d9871
mov eax, dword [ebp - 0x14e0]
add eax, 1
mov dword [ebp - 0x14e0], eax
mov ecx, dword [ebp - 0x14e0]
cmp ecx, dword [ebp - 0x1564]
ja 0x100d9937
lea esi, [ebp - 0x164]
mov eax, dword [ebp - 0x14e0]
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14e0], 0x80000002
jne 0x100d98d0
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x44], edx
jmp 0x100d9932
cmp dword [ebp - 0x14e0], 0x80000003
jne 0x100d9902
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x34], eax
jmp 0x100d9932
cmp dword [ebp - 0x14e0], reloc.WS2_32.dll_connect
jne 0x100d9932
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x24], ecx
jmp 0x100d9862
mov edx, dword [ebp - 0x1590]
push edx
lea eax, [ebp - 0x1288]
push eax
call fcn.100577b0
add esp, 8
mov dword [ebp - 0x1558], eax
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x126c]
call fcn.100450b0
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x154c]
mov dword [ebp - 0x1540], eax
mov byte [ebp - 4], 7
movzx ecx, byte [ebp - 0x14fb]
push ecx
push 0x10205c90
lea ecx, [ebp - 0x116c]
call fcn.100f7940
mov ecx, eax
call fcn.10090ee0
push eax
mov edx, dword [ebp - 0x1540]
push edx
lea eax, [ebp - 0x12a4]
push eax
call fcn.100e5a80
add esp, 0xc
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1550]
mov dword [ebp - 0x1544], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x155c]
push edx
mov eax, dword [ebp - 0x1544]
push eax
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.100e8300
add esp, 0xc
mov dword [ebp - 0x1554], eax
mov edx, dword [ebp - 0x1554]
mov dword [ebp - 0x1524], edx
mov byte [ebp - 4], 9
movzx eax, byte [ebp - 0x14fd]
push eax
push str._Core_s_
lea ecx, [ebp - 0x1230]
call fcn.100f79c0
mov ecx, eax
call fcn.1004cf40
push eax
mov ecx, dword [ebp - 0x1524]
push ecx
lea edx, [ebp - 0x12dc]
push edx
call fcn.100e5a80
add esp, 0xc
mov dword [ebp - 0x1528], eax
mov eax, dword [ebp - 0x1528]
push eax
mov ecx, dword [ebp - 0x14d8]
add ecx, 0x1f0
call fcn.1004dd80
lea ecx, [ebp - 0x12dc]
call fcn.10044fc0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12c0]
call fcn.10044fc0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x12a4]
call fcn.10044fc0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x126c]
call fcn.10044fc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1288]
call fcn.10044fc0
push 0x100f7890
mov ecx, dword [ebp - 0x14d8]
add ecx, 0x1f0
call fcn.10044d80
push eax
movzx ecx, byte [ebp - 0x14fc]
push ecx
push str._______CPU:
lea ecx, [ebp - 0x1240]
call fcn.100f7ad0
mov ecx, eax
call fcn.10072490
push eax
lea edx, [ebp - 0x1654]
push edx
call fcn.100f7570
add esp, 8
push eax
call fcn.100f7570
add esp, 8
mov ecx, eax
call fcn.100e0960
mov eax, dword [ebp - 0x14d8]
add eax, 0x1f0
push eax
mov ecx, 0x102c7768
call fcn.10044f80
call fcn.100cb0c0
mov ecx, dword [ebp - 0x14d8]
mov dword [ecx + 0x1d8], eax
mov dword [ecx + 0x1dc], edx
push 8
call fcn.10154550
add esp, 4
mov dword [ebp - 0x1510], eax
cmp dword [ebp - 0x1510], 0
je 0x100d9b59
xor edx, edx
mov eax, dword [ebp - 0x1510]
mov dword [eax], edx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1510]
mov dword [ebp - 0x1518], ecx
jmp 0x100d9b63
mov dword [ebp - 0x1518], 0
mov edx, dword [ebp - 0x1518]
mov dword [ebp - 0x1508], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x152c], eax
lea eax, [ebp - 0x1184]
push eax
mov ecx, dword [ebp - 0x152c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x1508]
mov eax, dword [ebp - 0x1178]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1508]
mov edx, dword [ebp - 0x117c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x14d8]
mov ecx, dword [ebp - 0x1508]
mov dword [eax + 0x20c], ecx
lea edx, [ebp - 0x1530]
push edx
push 0x1000
lea eax, [ebp - 0x1164]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100d9db0
mov ecx, dword [ebp - 0x1530]
shr ecx, 2
mov dword [ebp - 0x1534], ecx
mov dword [ebp - 0x14e4], 0
jmp 0x100d9c09
mov edx, dword [ebp - 0x14e4]
add edx, 1
mov dword [ebp - 0x14e4], edx
mov eax, dword [ebp - 0x14e4]
cmp eax, dword [ebp - 0x1534]
jae 0x100d9db0
mov ecx, dword [ebp - 0x14e4]
cmp dword [ebp + ecx*4 - 0x1164], 0
je 0x100d9dab
mov edx, dword [ebp - 0x14e4]
mov eax, dword [ebp + edx*4 - 0x1164]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x150c], eax
cmp dword [ebp - 0x150c], 0
je 0x100d9dab
lea ecx, [ebp - 0x157c]
push ecx
push 4
lea edx, [ebp - 0x1538]
push edx
mov eax, dword [ebp - 0x150c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100d9dab
push 0x104
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x1538]
push edx
mov eax, dword [ebp - 0x150c]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea ecx, [ebp - 0x11b4]
call fcn.100d9e30
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x14e4]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [ebp - 0x11b4], edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x11b0]
call fcn.10044f60
mov ecx, dword [ebp - 0x14e4]
mov edx, dword [ebp + ecx*4 - 0x1164]
mov dword [0x1024c8cc], edx
mov ecx, 0x102c7a74
call fcn.10044840
push 0
push 0x100d8ff0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x1514], 0x102c7a74
mov ecx, dword [ebp - 0x1514]
call fcn.10040fe0
mov dword [ebp - 0x14f0], eax
mov ecx, dword [ebp - 0x1514]
call fcn.10044820
mov dword [ebp - 0x153c], eax
jmp 0x100d9d3d
mov eax, dword [ebp - 0x14f0]
add eax, 0x1c
mov dword [ebp - 0x14f0], eax
mov ecx, dword [ebp - 0x14f0]
cmp ecx, dword [ebp - 0x153c]
je 0x100d9d84
mov edx, dword [ebp - 0x14f0]
push edx
lea ecx, [ebp - 0x11ec]
call fcn.10045280
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x11ec]
push eax
lea ecx, [ebp - 0x1194]
call fcn.10044a10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11ec]
call fcn.10044fc0
jmp 0x100d9d2e
lea ecx, [ebp - 0x11b4]
push ecx
mov ecx, dword [ebp - 0x14d8]
add ecx, 0x210
call fcn.100e2090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11b4]
call fcn.100d9e90
jmp 0x100d9bfa
lea ecx, [ebp - 0x1654]
call fcn.100e0610
mov edx, dword [ebp - 0x14d8]
add edx, 0x210
push edx
mov ecx, 0x102c78f4
call fcn.100e2050
push 0
push 0
mov eax, dword [ebp - 0x14d8]
push eax
push 0x100ca050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14d8]
mov dword [ecx + 0x158], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1654]
call fcn.100d9e60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret