Function at 0x1001f480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008332d
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100ac1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1d0], 0
test ecx, ecx
je 0x10020830
test eax, eax
je 0x10020830
mov edx, 2
mov word [eax], dx
lea eax, [ecx + 2]
push eax
call fcn.10032660
mov esi, eax
add esp, 4
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 4], 0
test esi, esi
jne 0x1001f506
mov dword [ebp - 4], 0xffffffff
jmp 0x10020830
push 0
mov dword [ebp - 0x188], 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x184], 0
push 0x10089c28
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
call fcn.10011cb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
push 4
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
push 0x1008b250
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
call fcn.10011cb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x168]
push esi
push eax
call fcn.100336d0
add esp, 0x10
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
cmp edx, 0x10
jb 0x1001f5ec
mov ecx, dword [ebp - 0x180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f5e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020852
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x184]
cmp edx, 0x10
jb 0x1001f645
mov ecx, dword [ebp - 0x198]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f63b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020857
push edx
push ecx
call fcn.1004774c
add esp, 8
push 0
mov dword [ebp - 0x1b8], 0
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x1b4], 0
push 0x10089c28
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0xf
mov byte [ebp - 0x1c8], 0
call fcn.10011cb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1b0]
push 7
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
push str.appname
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
call fcn.10011cb0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x150]
push esi
push eax
call fcn.100336d0
add esp, 0x10
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x19c]
cmp edx, 0x10
jb 0x1001f746
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f73c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002085c
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1b4]
cmp edx, 0x10
jb 0x1001f79f
mov ecx, dword [ebp - 0x1c8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f795
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020861
push edx
push ecx
call fcn.1004774c
add esp, 8
push 0
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10c], 0
push 0x10089c28
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0xf
mov byte [ebp - 0x1c8], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
call fcn.10011cb0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x108]
push 7
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
push str.cmdline
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0xf
mov byte [ebp - 0x108], 0
call fcn.10011cb0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.100336d0
add esp, 0x10
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xf4]
cmp edx, 0x10
jb 0x1001f8a0
mov ecx, dword [ebp - 0x108]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f896
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020866
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0xf
mov byte [ebp - 0x108], 0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x10c]
cmp edx, 0x10
jb 0x1001f8f9
mov ecx, dword [ebp - 0x120]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f8ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002086b
push edx
push ecx
call fcn.1004774c
add esp, 8
movaps xmm0, xmmword [0x1008b7a0]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
movups xmmword [ebp - 0x1fc], xmm0
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e4], 0
mov byte [ebp - 4], 0x10
lea edi, [ebp - 0x168]
cmp dword [ebp - 0x154], 0x10
cmovae edi, dword [ebp - 0x168]
push edi
mov dword [ebp - 0x1d8], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xfde9
mov dword [ebp - 0x1cc], eax
call edi
mov dword [ebp - 0x1f0], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100adb4a
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10047c12
add esp, 8
mov dword [ebp - 0x1fc], eax
test eax, eax
je 0x1001f9dd
push dword [ebp - 0x1f0]
push eax
push dword [ebp - 0x1cc]
push dword [ebp - 0x1d8]
push 0
push 0xfde9
call edi
mov eax, dword [ebp - 0x1f0]
xor edx, edx
mov ecx, dword [ebp - 0x1fc]
mov word [ecx + eax*2], dx
movaps xmm0, xmmword [0x1008b7a0]
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x150]
cmp dword [ebp - 0x13c], 0x10
cmovae eax, dword [ebp - 0x150]
push eax
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x1d8], eax
push 0
push 0xfde9
call edi
mov dword [ebp - 0x228], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100adb4a
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10047c12
mov edi, eax
add esp, 8
mov dword [ebp - 0x234], edi
test edi, edi
je 0x1001faa5
push dword [ebp - 0x228]
push edi
push dword [ebp - 0x1d8]
push dword [ebp - 0x1cc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x228]
xor ecx, ecx
mov word [edi + eax*2], cx
movaps xmm0, xmmword [0x1008b7a0]
movups xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x200], 0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x124], 0x10
cmovae eax, dword [ebp - 0x138]
push eax
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x1d8], eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x20c], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
push 0x100adb4a
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10047c12
add esp, 8
mov dword [ebp - 0x218], eax
test eax, eax
je 0x1001fb75
push dword [ebp - 0x20c]
push eax
push dword [ebp - 0x1d8]
push dword [ebp - 0x1cc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20c]
xor edx, edx
mov ecx, dword [ebp - 0x218]
mov word [ecx + eax*2], dx
push str.createprocess
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001fe8a
mov ecx, dword [0x100ad9b8]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1d8], eax
test ecx, ecx
jne 0x1001fc06
push 0x100ab068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100ad9b8], 0
jne 0x1001fbf5
push 4
call fcn.1004771c
add esp, 4
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1001fbdf
mov ecx, eax
call fcn.10013a50
jmp 0x1001fbe1
xor eax, eax
mov byte [ebp - 4], 0x12
xor edx, edx
lea ecx, [ebp - 0x1dc]
lock or dword [ecx], edx
mov dword [0x100ad9b8], eax
push 0x100ab068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100ad9b8]
push edi
call fcn.10013b50
test eax, eax
je 0x1001fc35
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp - 0x218]
push edi
call fcn.10016000
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
call fcn.10032410
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x14
test esi, esi
jne 0x1001fc53
mov byte [ebp - 4], 0x12
jmp 0x1001fcd8
cmp dword [ebp - 0x1d8], 0
je 0x1001fc63
call fcn.100324c0
jmp 0x1001fc68
call fcn.10032380
push eax
push str.result
push esi
call fcn.10032300
mov eax, dword [ebp - 0x1d0]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008b790]
movsd qword [esp], xmm0
call fcn.100323b0
push eax
push str.processid
push esi
call fcn.10032300
push esi
call fcn.100326c0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x1001fd44
mov byte [ebp - 4], 0x12
push esi
call fcn.100324f0
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x218]
call fcn.1001b370
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x234]
call fcn.1001b370
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1fc]
call fcn.1001b370
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.10005800
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.10005800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10005800
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1d4]
jmp 0x1002081e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x1ffe
ja 0x1001fd72
mov edx, dword [ebp - 0x1e0]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x1d0]
lea eax, [edx + 2]
mov word [edx], cx
push eax
call fcn.1004fe30
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.10055f63
mov byte [ebp - 4], 0x12
push esi
call fcn.100324f0
add esp, 8
mov dword [ebp - 0x1cc], 0
mov esi, dword [ebp - 0x1d4]
mov byte [ebp - 4], 0x11
push dword [ebp - 0x218]
call fcn.10047763
push 0
mov dword [ebp - 0x218], 0
call fcn.10047763
push 0
mov dword [ebp - 0x214], 0
call fcn.10047763
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.10047763
push 0
mov dword [ebp - 0x234], 0
call fcn.10047763
push 0
mov dword [ebp - 0x230], 0
call fcn.10047763
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x1fc]
call fcn.10047763
push 0
mov dword [ebp - 0x1fc], 0
call fcn.10047763
push 0
mov dword [ebp - 0x1f8], 0
call fcn.10047763
add esp, 0x24
mov dword [ebp - 0x1f4], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x10020749
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002073f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020870
jmp 0x1002073f
push str.CreateProcessAsSystem
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10020211
push 0x40
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push eax
call fcn.100503b0
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x100], xmm0
test edi, edi
je 0x1002015d
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1002015d
mov ecx, dword [0x100ad9b8]
test ecx, ecx
jne 0x1001ff40
push 0x100ab068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100ad9b8], 0
jne 0x1001ff2f
push 4
call fcn.1004771c
add esp, 4
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1001ff19
mov ecx, eax
call fcn.10013a50
jmp 0x1001ff1b
xor eax, eax
mov byte [ebp - 4], 0x12
xor edx, edx
lea ecx, [ebp - 0x1dc]
lock or dword [ecx], edx
mov dword [0x100ad9b8], eax
push 0x100ab068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100ad9b8]
push edi
call fcn.10013b50
test eax, eax
je 0x100206e0
push 0x10089d34
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1d0], eax
test eax, eax
je 0x1001ff8c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x1d0]
mov dword [ebp - 0x110], eax
call esi
mov dword [ebp - 0x10c], eax
jmp 0x1001ff92
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x1001ffa9
test eax, eax
je 0x1001ffa9
lea eax, [ebp - 0x114]
push eax
call ecx
mov byte [ebp - 4], 0x16
push dword [ebp - 0x218]
call fcn.10057e53
add esp, 4
mov esi, eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov dword [ebp - 0x1d0], eax
call fcn.10055f63
add esp, 4
cmp dword [ebp - 0x1d0], 0
je 0x1002000a
push dword [ebp - 0xfc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x100]
call esi
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1d8], eax
call fcn.10032410
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x17
test esi, esi
jne 0x10020034
mov byte [ebp - 4], 0x16
jmp 0x100200b5
cmp dword [ebp - 0x1d0], 0
je 0x10020044
call fcn.100324c0
jmp 0x10020049
call fcn.10032380
push eax
push str.result
push esi
call fcn.10032300
mov eax, dword [ebp - 0x1d8]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008b790]
movsd qword [esp], xmm0
call fcn.100323b0
push eax
push str.processid
push esi
call fcn.10032300
push esi
call fcn.100326c0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x100200e1
mov byte [ebp - 4], 0x16
push esi
call fcn.100324f0
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x1001fcd8
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x1001fcd8
push dword [ebp - 0x114]
call eax
jmp 0x1001fcd8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x1ffe
ja 0x1002010f
mov edx, dword [ebp - 0x1e0]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x1d0]
lea eax, [edx + 2]
mov word [edx], cx
push eax
call fcn.1004fe30
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.10055f63
mov byte [ebp - 4], 0x16
push esi
call fcn.100324f0
add esp, 8
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x1001fd94
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x1001fd94
push dword [ebp - 0x114]
call eax
jmp 0x1001fd94
mov byte [ebp - 4], 0x11
push dword [ebp - 0x218]
call fcn.10047763
push 0
mov dword [ebp - 0x218], 0
call fcn.10047763
push 0
mov dword [ebp - 0x214], 0
call fcn.10047763
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x10
push edi
call fcn.10047763
push 0
mov dword [ebp - 0x234], 0
call fcn.10047763
push 0
mov dword [ebp - 0x230], 0
call fcn.10047763
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xf
push dword [ebp - 0x1fc]
call fcn.10047763
push 0
mov dword [ebp - 0x1fc], 0
call fcn.10047763
push 0
mov dword [ebp - 0x1f8], 0
call fcn.10047763
add esp, 0x24
mov dword [ebp - 0x1f4], 0
jmp 0x1002070d
push str.SetImmersiveControlPanelAppid
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100205e5
movups xmm0, xmmword [str.microsoft.windows.immersivecontrolpanel]
mov ecx, 0x24
lea edi, [ebp - 0xf0]
mov esi, str.windows.immersivecontrolpanel_10.0.1.1000_neutral_neutral_cw5n1h2txyewy
movups xmmword [ebp - 0x60], xmm0
push 0xa
movups xmm0, xmmword [0x1008b308]
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x234]
movups xmmword [ebp - 0x50], xmm0
push edi
movups xmm0, xmmword [0x1008b318]
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x1008b328]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x1008b338]
movups xmmword [ebp - 0x20], xmm0
call fcn.10057dc8
add esp, 0xc
mov dword [ebp - 0x1dc], eax
test eax, eax
je 0x1001fcd8
mov esi, dword [str.8FA908C0_EAC5_47F9_8074_FFC5EBBEB255]
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10020875
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1cc]
push esi
call fcn.100079e0
test al, al
jne 0x100202fc
test esi, esi
jne 0x100202d4
xor ecx, ecx
jmp 0x100202ef
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100202e0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x1cc]
call fcn.1000ffb0
mov byte [ebp - 4], 0x19
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x1002087f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1d8], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1d8]
push str.LREXJzUYfYA
call fcn.100079e0
test al, al
jne 0x10020349
push 0xc
push str.LREXJzUYfYA
lea ecx, [ebp - 0x1d8]
call fcn.1000ffb0
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.1002f1d0
add esp, 0xc
mov byte [ebp - 4], 0x1c
mov edx, dword [eax]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 7
lea esi, [ecx + 2]
mov word [ebp - 0x108], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100203a6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x108]
call fcn.10011da0
mov byte [ebp - 4], 0x1e
or esi, 0xffffffff
mov edx, dword [ebp - 0x1d0]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100203e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x20
mov eax, esi
mov edx, dword [ebp - 0x1d8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10020407
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x1cc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10020426
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xf4], 8
lea eax, [ebp - 0x108]
cmovae eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
push dword [ebp - 0x1dc]
call fcn.1001a960
xor ecx, ecx
add esp, 0x10
test eax, eax
setns cl
mov dword [ebp - 0x1dc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1d0], eax
call fcn.10032410
mov esi, eax
mov dword [ebp - 0x1cc], esi
mov byte [ebp - 4], 0x24
test esi, esi
jne 0x1002049a
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x108]
call fcn.10005880
jmp 0x1001fcd8
cmp dword [ebp - 0x1dc], 0
je 0x100204aa
call fcn.100324c0
jmp 0x100204af
call fcn.10032380
push eax
push str.result
push esi
call fcn.10032300
mov eax, dword [ebp - 0x1d0]
add esp, 0xc
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008b790]
movsd qword [esp], xmm0
call fcn.100323b0
push eax
push str.processid
push esi
call fcn.10032300
push esi
call fcn.100326c0
add esp, 0x18
mov dword [ebp - 0x1d0], eax
test eax, eax
jne 0x1002052f
mov byte [ebp - 4], 0x22
push esi
call fcn.100324f0
add esp, 4
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x108]
call fcn.10005880
jmp 0x1001fcd8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 0x1ffe
ja 0x1002055d
mov edx, dword [ebp - 0x1e0]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x1d0]
lea eax, [edx + 2]
mov word [edx], cx
push eax
call fcn.1004fe30
add esp, 0xc
push dword [ebp - 0x1d0]
call fcn.10055f63
mov byte [ebp - 4], 0x22
push esi
call fcn.100324f0
add esp, 8
mov dword [ebp - 0x1cc], 0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0xf4]
cmp edx, 8
jb 0x100205c3
mov ecx, dword [ebp - 0x108]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100205b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020889
push edx
push ecx
call fcn.1004774c
add esp, 8
xor eax, eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 7
mov word [ebp - 0x108], ax
jmp 0x1001fd94
push str.LoadLibraryEx
push dword [ebp - 0x1fc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001fd9a
push edi
mov dword [ebp - 0x1cc], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x100206b9
push edi
call fcn.1001c870
add esp, 4
test eax, eax
je 0x100206b9
lea ecx, [ebp - 0x114]
call fcn.1001afd0
mov byte [ebp - 4], 0x25
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1cc], eax
test eax, eax
je 0x1002069a
cmp dword [ebp - 0x128], 0
jne 0x10020663
push 0x17
push str.LoadLibraryExThreadProc
lea ecx, [ebp - 0x138]
call fcn.10011cb0
cmp dword [ebp - 0x124], 0x10
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
push eax
push dword [ebp - 0x1cc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002069a
push dword [ebp - 0x1e0]
call eax
mov dword [ebp - 0x1d0], 1
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x110], 0
je 0x100206b9
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x100206b9
push dword [ebp - 0x114]
call eax
push dword [ebp - 0x1cc]
push str.ModuleHandle
push dword [ebp - 0x1e0]
push dword [ebp - 0x1d0]
call fcn.1001e990
add esp, 0x10
test eax, eax
jne 0x1001fd9a
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x218]
call fcn.1001b370
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x234]
call fcn.1001b370
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1fc]
call fcn.1001b370
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.10005800
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.10005800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.10005800
jmp 0x10020816
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x13c]
cmp edx, 0x10
jb 0x100207a2
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10020798
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002088e
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x154]
cmp edx, 0x10
jb 0x100207fb
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100207f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020893
push edx
push ecx
call fcn.1004774c
add esp, 8
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.100324f0
mov dword [ebp - 0x1d4], 0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047acb
mov esp, ebp
pop ebp
ret 0xc
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
push 0x80004005
call fcn.100079c0
push 0x80004005
call fcn.100079c0
call fcn.100534b3
call fcn.100534b3
call fcn.100534b3
int3