Function at 0x1001435
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0x1001aaf
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call 0x10010df
mov dword [0x1003014], eax
cmp dword [0x1003008], ebx
jne 0x1001ae8
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 6
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, esi
jl 0x100119d
lea eax, [ebp - 0x10]
push eax
push 0x10011e8
push 1
push esi
push 0x10011f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, esi
jl 0x1001197
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
cmp word [eax], si
je 0x100117f
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 0x10]
push ecx
push esi
push eax
call fcn.0100168c
test eax, eax
jl 0x100117f
lea eax, [ebp - 8]
push eax
push 0x10011bc
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.0100158d
lea eax, [ebp - 0xc]
push eax
push 0x10011ac
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.0100158d
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
cmp edi, esi
pop edi
setl al
pop esi
leave
ret 0x10
call fcn.010012b0
push 0x5c
push 0x1001548
call fcn.0100125e
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1003024
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1001a61
xor esi, esi
inc esi
mov eax, dword [0x1003020]
cmp eax, esi
je 0x1001a80
mov eax, dword [0x1003020]
test eax, eax
jne 0x100157d
mov dword [0x1003020], esi
push 0x1001544
push 0x1001538
call fcn.01001638
pop ecx
pop ecx
test eax, eax
jne 0x1001b0b
mov eax, dword [0x1003020]
cmp eax, esi
jne 0x10014e8
push 0x1001534
push 0x100152c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003020], 2
cmp dword [ebp - 0x20], ebx
jne 0x10014f5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1003368], ebx
jne 0x1001a8d
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1001b0b
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x100165c
cmp cx, 0x22
je 0x1001570
inc eax
inc eax
jmp 0x1001510
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x1001526
mov dword [0x100336c], esi
jmp 0x10014c4
cmp cx, bx
je 0x100166a
cmp dword [ebp - 0x1c], ebx
jne 0x1001520
movzx ecx, word [eax]
cmp cx, bx
je 0x10010a8
cmp cx, 0x20
ja 0x10010a8
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100166a
cmp eax, esi
jne 0x1001a70
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100148b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001477
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10014c4
push 0x1003368
call fcn.01001d9f
pop ecx
test eax, eax
je 0x1001501
push ebx
push 2
push ebx
call dword [0x1003368]
jmp 0x1001501
movzx ecx, word [ebp - 0x3c]
jmp 0x10010b5
cmp dword [0x100336c], ebx
jne 0x1001af6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003014]
jmp 0x1001b17
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100190c
ret