Function at 0x10760a3
Capabilities:
Create thread
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0xff
call fcn.010207aa
movsx ebx, word [eax + 0xad4]
xor eax, eax
imul ebx, ebx, 0x258
mov edi, 0x10d72a8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, 0x10d72c8
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0106fac8
xor edi, edi
test ax, ax
je 0x1076146
cmp word [ebp + 0xc], di
je 0x1076146
call fcn.0104a1c9
call fcn.01070634
lea eax, [ebp - 0x30]
push eax
call fcn.010721d4
lea eax, [ebp - 0x30]
push eax
call fcn.01071dd3
push eax
call fcn.010756c1
cmp eax, edi
je 0x1076133
add eax, 0x14
push eax
call fcn.0106fb41
mov dword [ebp - 8], 1
mov esi, 0x10d72c8
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.010706cc
xor edi, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0106fac8
test ax, ax
jne 0x1076183
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push edi
push 0x10102d0
lea eax, [ebp - 0x230]
push eax
call fcn.010749b1
or esi, 0xffffffff
cmp eax, esi
mov dword [0x10d73d4], eax
jne 0x1076192
call fcn.0104a237
mov eax, 0x4c7
jmp 0x10762f4
call fcn.0104a1c9
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push 0x1072373
push edi
push edi
mov dword [0x10d73a0], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [0x10d73cc], eax
je 0x107623d
mov dword [ebp + 0xc], edi
jmp 0x1076223
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x4b0
jl 0x10761d3
call fcn.0104a1a4
cmp dword [0x10d73c0], edi
jne 0x10761e9
mov eax, ebx
dec ebx
test eax, eax
jg 0x10761e9
mov dword [ebp - 4], 1
call fcn.01049d7a
test eax, eax
je 0x1076202
cmp word [ebp - 4], di
jne 0x1076202
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x107621e
mov eax, dword [0x10d73d4]
cmp eax, esi
mov dword [ebp - 4], 1
je 0x1076218
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
mov dword [0x10d73d4], esi
call fcn.0106e781
cmp dword [0x10d73a0], esi
je 0x10761c2
push dword [0x10d73cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10d73cc], edi
mov eax, dword [0x10d73d4]
cmp eax, esi
je 0x1076252
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
mov dword [0x10d73d4], esi
mov ebx, dword [0x10d73a0]
call fcn.0104a237
cmp ebx, edi
jne 0x1076279
cmp word [ebp - 4], di
je 0x1076298
push edi
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [0x10ceff4]
call sub.NTMSAPI.dll_DismountNtmsMedia
cmp word [ebp - 4], di
je 0x107628e
cmp word [ebp - 8], di
je 0x107628e
lea eax, [ebp - 0x1c]
push eax
call fcn.01075628
cmp ebx, edi
jne 0x10762c9
cmp word [ebp - 4], di
jne 0x10762c9
cmp word [ebp + 8], 0
mov esi, 0x10d72a8
mov edi, 0x10d72e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10d72c8
mov edi, 0x10d7354
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10762c2
call fcn.0104a0c8
jmp 0x10762c7
call fcn.0104adb1
xor edi, edi
cmp dword [0x10d3578], edi
mov esi, 0x3e3
jne 0x10762ea
push edi
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [0x10ceff4]
call sub.NTMSAPI.dll_DismountNtmsMedia
mov ebx, esi
cmp word [ebp - 4], di
je 0x10762f2
mov ebx, esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8