Function at 0x1011160
Capabilities:
Create thread
Get common file path
Get token privileges

Disassembly:
push 0x238
push 0x1003a18
call fcn.010145b0
mov eax, dword [0x102c22c]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], esi
push 0x104
lea eax, [ebp - 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10111c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10039e0
mov dword [ebp - 0x228], eax
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x101125c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x248], edi
cmp edi, esi
je 0x10111a6
push 0x40e
push edi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
call esi
mov dword [ebx + 0x24], eax
push 0x40f
push edi
call esi
mov dword [ebx + 0x28], eax
mov esi, 0x2bc
push esi
push 0x3fb
push dword [ebx + 0x24]
mov edi, 0x404
push edi
push dword [ebx + 4]
call fcn.0100bee8
cmp dword [ebx + 8], 0
jne 0x1011252
call fcn.01016306
shr eax, 8
mov dword [0x106e3e0], eax
xor eax, eax
cmp dword [0x102c8d0], eax
jne 0x101129e
cmp dword [0x102dc60], eax
je 0x101127b
push 0x103ec40
call fcn.0100f263
test eax, eax
jne 0x101129e
push 0x1003998
call fcn.01015c42
mov dword [ebp - 0x228], 0x4c7
or dword [ebp - 4], 0xffffffff
call fcn.010119e9
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x1c]
call fcn.0101439a
call fcn.010145eb
ret 4
cmp dword [0x102de54], eax
jne 0x101129e
push 0x106e520
push dword [0x103f3c4]
call fcn.0100f062
test eax, eax
jne 0x101129e
push 0x1003960
jmp 0x10112f4
cmp dword [0x102c8d0], 0
jne 0x10112ff
push 0x103ec40
push 0x1003944
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.0100d9ee
add esp, 0x10
cmp dword [0x102de54], 0
jne 0x10112ff
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.01017367
test eax, eax
jne 0x10112ff
push dword [0x103dfdc]
call fcn.010107d9
test eax, eax
jne 0x10112ff
push 0x1003908
call fcn.01015c5a
pop ecx
jmp 0x1011252
push 0x190
push 0x3fb
push dword [ebx + 0x28]
push edi
push dword [ebx + 4]
call fcn.0100bee8
xor edi, edi
cmp dword [0x102c8f0], edi
jne 0x101137e
push esi
push 0x3fc
push dword [ebx + 0x24]
push 0x405
push dword [ebx + 4]
call fcn.0100bee8
call fcn.01014f92
mov dword [0x103ed44], eax
push 0x103ec40
call fcn.0101a1e9
mov dword [0x103f940], eax
mov ecx, dword [0x103ed44]
cmp ecx, eax
jae 0x101137e
push ecx
push eax
push 0x10038b0
call fcn.01015c5a
add esp, 0xc
mov esi, 0xf003
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x228], esi
jmp 0x101125c
push ebx
call fcn.0100da1c
cmp dword [ebx + 8], edi
jne 0x1011252
cmp dword [0x103ec30], 1
je 0x1011252
mov eax, dword [0x106f76c]
mov dword [ebp - 0x238], eax
mov dword [0x107f89c], edi
lea eax, [ebp - 0x244]
push eax
push edi
lea eax, [ebp - 0x238]
push eax
push 0x10190a7
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x106e3d4], eax
push 0x103e488
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x22c], eax
cmp eax, edi
jne 0x10113fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003878
jmp 0x10111b8
push 0x11
call fcn.01014eda
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x101141b
call esi
push eax
push 0x1003828
call fcn.01015c5a
pop ecx
pop ecx
push 0x12
call fcn.01014eda
test eax, eax
jne 0x1011435
call esi
push eax
push 0x10037d8
call fcn.01015c5a
pop ecx
pop ecx
push 0x13
call fcn.01014eda
test eax, eax
jne 0x101144f
call esi
push eax
push 0x1003788
call fcn.01015c5a
pop ecx
pop ecx
push 8
call fcn.01014eda
test eax, eax
jne 0x1011469
call esi
push eax
push 0x1003738
call fcn.01015c5a
pop ecx
pop ecx
push 9
call fcn.01014eda
test eax, eax
jne 0x1011483
call esi
push eax
push 0x10036e0
call fcn.01015c5a
pop ecx
pop ecx
push 0x103ef68
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
push 0x102c210
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x22c], eax
cmp eax, edi
jne 0x10114b9
call esi
push eax
push 0x100369c
jmp 0x10111b8
lea eax, [ebp - 0x228]
push eax
push 0xfffa
push 0x107f8a0
push 4
push dword [0x103e488]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x22c], eax
cmp eax, edi
jne 0x10114e9
call esi
jmp 0x101158f
push 0x104
push 0x106e400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x101150a
call esi
push eax
push 0x1003660
jmp 0x10111b2
push dword [0x107f8a0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x230], eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [0x103ec2c], eax
cmp eax, edi
jne 0x1011544
push 0x1003628
call fcn.01015c42
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101125c
mov ecx, dword [ebp - 0x230]
mov esi, dword [0x107f8a0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x228]
push eax
push 0xfffa
push 0x107f8a0
push 1
push dword [0x103e488]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x22c], eax
test eax, eax
jne 0x101159a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10035ec
jmp 0x10111b8
and dword [ebp - 0x228], 0
push dword [0x107f8a0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x230], eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [0x103e490], eax
test eax, eax
jne 0x10115ce
push 0x10035b4
jmp 0x1011532
mov ecx, dword [ebp - 0x230]
mov esi, dword [0x107f8a0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x10119b4
cmp dword [0x103ec30], 1
je 0x10119b4
push 0x102c8cc
push 0x103f930
push 0x10035a0
push dword [0x103e484]
call fcn.01017e79
mov dword [ebp - 0x228], eax
cmp eax, esi
je 0x1011650
push eax
push 0x1003558
call fcn.01015c5a
pop ecx
pop ecx
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xe03
jmp 0x10119d2
cmp dword [0x102dc60], esi
je 0x1011740
push ebx
mov edi, 0x103ec40
push edi
call fcn.0100df79
test eax, eax
je 0x101171d
mov ebx, dword [ebx + 0x20]
cmp ebx, esi
je 0x1011683
cmp ebx, 0xbc2
jne 0x1011730
push esi
xor ebx, ebx
inc ebx
push ebx
push esi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
push dword [0x103f3c4]
push edi
call fcn.0101e1be
mov dword [ebp - 0x22c], eax
cmp eax, esi
je 0x10116e8
cmp dword [ebp - 0x23c], esi
jne 0x10116dc
cmp dword [ebp - 0x234], esi
jne 0x10116dc
push dword [0x103e7e4]
push dword [0x103ec2c]
push edi
call fcn.0101f5cb
push 0x106e520
call fcn.01019cce
jmp 0x10116fb
push 0x1003500
call fcn.01015c5a
jmp 0x10116fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10034a8
call fcn.01015c5a
pop ecx
pop ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x103f6ec], 5
jmp 0x101125c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003458
call fcn.01015c5a
pop ecx
pop ecx
mov dword [ebp - 0x22c], esi
push 0x643
jmp 0x1011539
push dword [0x103f3c4]
call fcn.01019749
mov dword [ebp - 0x22c], eax
cmp eax, esi
jne 0x1011777
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1003418
call fcn.01015c5a
pop ecx
pop ecx
call esi
push eax
push 0xe41
jmp 0x10119d2
mov edi, 0x190
push edi
push 0x3fc
push dword [ebx + 0x28]
push 0x405
push dword [ebx + 4]
call fcn.0100bee8
push 0x2bc
mov esi, 0x411
push esi
push dword [ebx + 0x24]
push 0x412
push dword [ebx + 4]
call fcn.0100bee8
push dword [0x103f3c4]
push dword [ebx + 4]
call fcn.0100fc15
push 0xfffa
push 0x102dfe0
push 0xf0b2
push 0
call fcn.0100e2c5
push 0x102dfe0
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
push esi
push dword [ebx + 0x28]
push 0x412
push dword [ebx + 4]
call fcn.0100bee8
push 0x2bc
push 0x3fd
push dword [ebx + 0x24]
add esi, 0xfffffff5
push esi
push dword [ebx + 4]
call fcn.0100bee8
cmp dword [0x103ec30], 1
jne 0x1011825
and dword [ebp - 0x22c], 0
push 0x4c7
jmp 0x1011539
mov dword [0x103f6ec], 4
cmp dword [0x103e104], 5
jne 0x10118a5
test dword [0x102de50], 0x40
jne 0x10118a5
push 0
push 0x103f1a0
push 0x103f2c0
call fcn.0101ef4c
xor eax, eax
cmp dword [0x102dc5c], eax
jne 0x10118a5
cmp dword [0x102dc60], eax
jne 0x10118a5
lea ecx, [ebp - 0x240]
push ecx
push eax
push dword [0x103ec2c]
push 1
push 0x10033fc
push 0x103ec40
push dword [0x103f3c4]
call fcn.0101ec1e
mov dword [ebp - 0x22c], eax
test eax, eax
jne 0x10118a5
push 0x10033c8
call fcn.01015c42
jmp 0x101125c
lea eax, [ebx + 0x14]
lea ecx, [ebx + 0x10]
push eax
push ecx
call fcn.01016d74
push 0x1003388
call fcn.01015c42
push dword [ebx + 0x14]
push dword [ebx + 0x10]
call fcn.0100b827
push edi
push 0x3fd
push dword [ebx + 0x28]
push esi
push dword [ebx + 4]
call fcn.0100bee8
push 0x2bc
push 0x3fe
push dword [ebx + 0x24]
push 0x407
push dword [ebx + 4]
call fcn.0100bee8
mov esi, 0x102c8cc
push esi
mov edi, 0x103ec40
push edi
push 1
mov ebx, 0x1003364
push ebx
push dword [0x103f3c4]
call fcn.01016f90
test eax, eax
jne 0x101192c
push 0x1003310
call fcn.01015c42
and dword [ebp - 0x22c], 0
jmp 0x101125c
push 0x104
push 0x103f500
push ebx
call fcn.01018155
test eax, eax
je 0x1011968
push esi
push edi
push 1
mov edi, 0x103f500
push edi
push dword [0x103f3c4]
call fcn.01016f90
test eax, eax
jne 0x1011968
push edi
push 0x10032d8
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1011920
push 0x1003290
push dword [0x103f3c4]
call fcn.010231cf
push esi
push 0x103f930
push 0x1003274
push dword [0x103e484]
call fcn.01017e79
mov dword [ebp - 0x228], eax
test eax, eax
je 0x101125c
push eax
push 0x1003240
call fcn.01015c5a
pop ecx
pop ecx
push dword [ebp - 0x228]
jmp 0x1011539
mov eax, 0x4c7
mov dword [ebp - 0x228], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdf8
push 0x1003208
push 0x10031c0
call fcn.01015c5a
add esp, 0x10
jmp 0x101125c