Function at 0x100bd27
Capabilities:
Get session user name
Initialize winsock library
Set environment variable
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x604
mov eax, dword [0x10106f0]
and dword [ebp - 0x5d8], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5dc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp eax, 0x3a4
je 0x100bd75
cmp eax, 0x3a8
je 0x100bd75
cmp eax, 0x3b4
jbe 0x100bd7c
cmp eax, 0x3b6
ja 0x100bd7c
or dword [0x102aa64], 7
push ebx
push esi
push edi
push 0xc0
push 0x1010710
call fcn.010020f9
xor esi, esi
xor edi, edi
inc edi
mov dword [0x1010754], edi
mov dword [0x101074c], esi
mov dword [0x1010748], esi
mov dword [0x1010710], esi
mov dword [0x1010714], esi
call fcn.0100a9b8
push esi
push 0x102a9d0
push 0x1001f58
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0100d129
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
pop ebx
push ebx
push 0x1027880
push 0x81
push dword [0x102a9d0]
call esi
push 0x1010710
call fcn.0100a9f9
lea eax, [ebp - 0x5c8]
push eax
push 0x101
mov dword [0x1010730], edi
mov dword [0x1010734], edi
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x100be35
push 0x1027880
push 0x10289e0
call fcn.0100b261
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x100c94d
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
sub eax, 0x3a4
mov edi, 0x3ff
je 0x100be6a
sub eax, 4
je 0x100be5b
sub eax, 0xd
je 0x100be6a
dec eax
je 0x100be6a
push 0x409
jmp 0x100be78
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, edi
or eax, 0x800
jmp 0x100be77
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, edi
or eax, 0x400
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x577
push 0x1029ee0
push 0x8e
push dword [0x102a9d0]
call esi
push ebx
push 0x1028360
push 0x8b
push dword [0x102a9d0]
call esi
mov edi, 0xfe
push edi
push 0x1028540
push 0x84
push dword [0x102a9d0]
call esi
push ebx
push 0x10282c0
push 0x7f
push dword [0x102a9d0]
call esi
push ebx
push 0x1027ee0
push 0x80
push dword [0x102a9d0]
call esi
push 0xff
push 0x1026b40
push 0x8a
push dword [0x102a9d0]
call esi
push ebx
push 0x1029d00
push 0x8d
push dword [0x102a9d0]
call esi
push edi
push 0x1028a80
push 0x87
push dword [0x102a9d0]
call esi
push edi
push 0x1026600
push 0xb9
push dword [0x102a9d0]
call esi
push ebx
push 0x1028fc0
push 0x384
push dword [0x102a9d0]
call esi
push ebx
push 0x10289e0
push 0xb5
push dword [0x102a9d0]
call esi
push 0x1ff
push 0x1029900
push 0xfa
push dword [0x102a9d0]
call esi
push ebx
push 0x1029860
push 0x387
push dword [0x102a9d0]
call esi
push ebx
push 0x1028c80
push 0xfb
push dword [0x102a9d0]
call esi
push edi
push 0x1026d40
push 0xfc
push dword [0x102a9d0]
call esi
push edi
push 0x1026940
push edi
push dword [0x102a9d0]
call esi
push ebx
push 0x1026800
push 0xff
push dword [0x102a9d0]
call esi
push ebx
push 0x1027a60
push 0x100
push dword [0x102a9d0]
call esi
push ebx
push 0x1027f80
push 0x101
push dword [0x102a9d0]
call esi
push ebx
push 0x1028400
push 0x102
push dword [0x102a9d0]
call esi
push ebx
push 0x1028f20
push 0x385
push dword [0x102a9d0]
call esi
push ebx
push 0x1026fe0
push 0x386
push dword [0x102a9d0]
call esi
push ebx
push 0x1029da0
push 0x103
push dword [0x102a9d0]
call esi
push ebx
push 0x10284a0
push 0x128
push dword [0x102a9d0]
call esi
push ebx
push 0x10268a0
push 0x104
push dword [0x102a9d0]
call esi
push ebx
push 0x1028740
push 0x105
push dword [0x102a9d0]
call esi
push ebx
push 0x1025d60
push 0x106
push dword [0x102a9d0]
call esi
push ebx
push 0x1027da0
push 0x108
push dword [0x102a9d0]
call esi
push ebx
push 0x1026f40
push 0x109
push dword [0x102a9d0]
call esi
push ebx
push 0x1027e40
push 0x10a
push dword [0x102a9d0]
call esi
push ebx
push 0x1027d00
push 0x10b
push dword [0x102a9d0]
call esi
push ebx
push 0x1028020
push 0x10c
push dword [0x102a9d0]
call esi
push ebx
push 0x10279c0
push 0x10d
push dword [0x102a9d0]
call esi
push ebx
push 0x1027920
push 0x10e
push dword [0x102a9d0]
call esi
push 0xff
push 0x1028d20
push 0x10f
push dword [0x102a9d0]
call esi
push edi
push 0x10287e0
push pe_nt_image_headers32
push dword [0x102a9d0]
call esi
push edi
push 0x10280c0
push 0x11c
push dword [0x102a9d0]
call esi
push edi
push 0x1027b00
push 0x112
push dword [0x102a9d0]
call esi
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a4
jne 0x100c1b7
mov al, byte [0x102aa64]
test al, 1
je 0x100c1b7
test al, 2
je 0x100c1b7
push 0x3ff
push 0x1025e00
push 0x11d
push dword [0x102a9d0]
call esi
push 0x3ff
push 0x1029060
push 0x11e
push dword [0x102a9d0]
call esi
push 0x3ff
push 0x1027080
push 0x11f
jmp 0x100c1f4
push 0x3ff
push 0x1025e00
push 0x111
push dword [0x102a9d0]
call esi
push 0x3ff
push 0x1029060
push 0x113
push dword [0x102a9d0]
call esi
push 0x3ff
push 0x1027080
push 0xfd
push dword [0x102a9d0]
call esi
push 0x1001f54
push 0x1001f3c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x10018e4
push 0x102aa80
call dword [sym.imp.msvcrt.dll_wcscpy]
push 0x10018e4
push 0x102b860
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 0x10
cmp dword [ebp + 8], 1
jle 0x100c6b4
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
mov dword [ebp - 0x5cc], eax
jle 0x100c6b4
mov edx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x5cc]
lea eax, [edx + eax*4]
mov dword [ebp - 0x5d0], eax
mov eax, dword [eax]
mov cx, word [eax]
cmp cx, 0x2d
je 0x100c375
cmp cx, 0x2f
je 0x100c375
cmp dword [ebp - 0x5d8], 0
jne 0x100c8f0
push eax
mov dword [ebp - 0x5d8], 1
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x7e
pop ecx
jae 0x100c2ae
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
jmp 0x100c2b1
push 0x7e
pop eax
push eax
mov eax, dword [ebp - 0x5d0]
push dword [eax]
push 0x10107e8
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [0x10109e8], 0
add esp, 0xc
inc dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp + 8]
jge 0x100c6b4
mov ecx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5d4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x5d0], eax
mov eax, dword [eax]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x100c32b
mov eax, dword [ebp - 0x5d0]
mov eax, dword [eax]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x100c32b
dec dword [ebp - 0x5cc]
jmp 0x100c69f
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, edi
pop ecx
jae 0x100c34f
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
jmp 0x100c351
mov eax, edi
push eax
mov eax, dword [ebp - 0x5d0]
push dword [eax]
push 0x10109e8
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
and word [0x1010be6], 0
jmp 0x100c69f
movzx ecx, word [eax + 2]
cmp ecx, 0x61
jg 0x100c3bd
je 0x100c38a
sub ecx, 0x41
je 0x100c38a
sub ecx, 4
jmp 0x100c3c0
cmp word [eax + 4], 0
jne 0x100c3b2
lea eax, [ebp - 0x5d0]
push eax
push 0x102aa80
mov dword [ebp - 0x5d0], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x100c69f
mov word [eax + 2], 0x3f
jmp 0x100c320
sub ecx, 0x65
je 0x100c674
dec ecx
je 0x100c58f
sub ecx, 6
je 0x100c4c1
sub ecx, 8
jne 0x100c8f0
cmp word [eax + 4], 0
jne 0x100c440
mov eax, dword [ebp - 0x5cc]
inc eax
cmp eax, dword [ebp + 8]
mov dword [ebp - 0x5cc], eax
jge 0x100c4da
mov ecx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5d4]
lea eax, [eax + ecx*4]
push dword [eax]
mov dword [ebp - 0x5d0], eax
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x18
pop ecx
jae 0x100c432
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100c435
push 0x18
pop eax
push eax
mov eax, dword [ebp - 0x5d0]
push dword [eax]
jmp 0x100c470
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
dec eax
cmp eax, 0x18
pop ecx
jae 0x100c460
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
dec eax
jmp 0x100c463
push 0x18
pop eax
push eax
mov eax, dword [ebp - 0x5d0]
mov eax, dword [eax]
add eax, 4
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [ebp - 8], 0
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
call fcn.0100279f
test eax, eax
mov dword [0x102b1d4], eax
jge 0x100c69f
push 0
lea eax, [ebp - 0x5dc]
push eax
mov esi, 0x10280c0
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push dword [0x1025d18]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100c8f5
cmp word [eax + 4], 0
jne 0x100c540
mov eax, dword [ebp - 0x5cc]
inc eax
cmp eax, dword [ebp + 8]
mov dword [ebp - 0x5cc], eax
jl 0x100c4f8
dec eax
mov dword [ebp - 0x5cc], eax
lea eax, [edx + eax*4]
mov ecx, dword [eax]
mov word [ecx], 0x2d
mov eax, dword [eax]
mov word [eax + 2], 0x3f
jmp 0x100c6a5
mov ecx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5d4]
lea eax, [eax + ecx*4]
push dword [eax]
mov dword [ebp - 0x5d0], eax
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x100
pop ecx
jae 0x100c530
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100c535
mov eax, 0x100
push eax
mov eax, dword [ebp - 0x5d0]
push dword [eax]
jmp 0x100c574
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
dec eax
cmp eax, 0x100
pop ecx
jae 0x100c562
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
dec eax
jmp 0x100c567
mov eax, 0x100
push eax
mov eax, dword [ebp - 0x5d0]
mov eax, dword [eax]
add eax, 4
push eax
push 0x102aa80
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
and word [0x102ac80], 0
jmp 0x100c69f
cmp word [eax + 4], 0
jne 0x100c600
inc dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp + 8]
jl 0x100c5b8
dec dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5cc]
jmp 0x100c4e1
mov ecx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5d4]
lea eax, [eax + ecx*4]
push dword [eax]
mov dword [ebp - 0x5d0], eax
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x105
pop ecx
jae 0x100c5f0
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100c5f5
mov eax, 0x105
push eax
mov eax, dword [ebp - 0x5d0]
push dword [eax]
jmp 0x100c640
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x105
pop ecx
jae 0x100c622
mov eax, dword [ebp - 0x5d0]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100c627
mov eax, 0x105
push eax
push 0x1001f34
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x5d0]
mov ecx, dword [ecx]
lea eax, [ecx + eax*2]
push eax
push 0x102b860
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [0x102ba6a], 0
add esp, 0xc
push 0x102b860
call fcn.010026e9
test eax, eax
je 0x100c8f9
mov dword [0x101074c], 1
jmp 0x100c69f
mov ax, word [eax + 4]
test ax, ax
jne 0x100c699
mov eax, dword [ebp - 0x5cc]
inc eax
cmp eax, dword [ebp + 8]
mov dword [ebp - 0x5cc], eax
jge 0x100c4da
mov eax, dword [edx + eax*4]
mov ax, word [eax]
mov word [0x100f028], ax
inc dword [ebp - 0x5cc]
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x5cc], eax
jl 0x100c24b
push 0x10018e4
push 0x102aa80
call dword [sym.imp.msvcrt.dll_wcscmp]
pop ecx
xor edi, edi
test eax, eax
pop ecx
je 0x100c726
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 0x102aa80
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
mov dword [ebp - 0x5d8], eax
je 0x100c94b
push eax
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
pop ecx
mov dword [0x1010be8], eax
je 0x100c94b
push edi
push edi
push dword [ebp - 0x5d8]
push eax
push 0xffffffffffffffff
push 0x102aa80
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov al, byte [0x102aa64]
test al, 1
mov dword [0x1025cc0], 0x1026800
mov dword [0x1025cc4], 0x1002293
mov dword [0x1025cc8], 0x1027a60
mov dword [0x1025ccc], 0x100237f
mov dword [0x1025cd0], 0x1027f80
mov dword [0x1025cd4], 0x100a18f
mov dword [0x1025cd8], 0x1028400
mov dword [0x1025cdc], 0x10032b8
mov dword [0x1025ce0], 0x1029da0
mov dword [0x1025ce4], 0x1003911
mov dword [0x1025ce8], 0x10284a0
mov dword [0x1025cec], 0x10039f3
mov dword [0x1025cf0], 0x10268a0
mov dword [0x1025cf4], 0x1002949
mov dword [0x1025cf8], 0x1028740
mov dword [0x1025cfc], 0x1003948
mov dword [0x1025d00], 0x1025d60
mov dword [0x1025d04], 0x1002f21
je 0x100c833
test al, 2
je 0x100c833
mov dword [ebp - 0x5d4], 0x100f880
mov eax, dword [ebp - 0x5d4]
push 0xff
lea ecx, [eax + 8]
push ecx
push dword [eax]
push dword [0x102a9d0]
call esi
add dword [ebp - 0x5d4], 0x210
cmp dword [ebp - 0x5d4], 0x10106f0
jl 0x100c7f1
push ebx
push 0x1029e40
push 0xc3
push dword [0x102a9d0]
call esi
push 1
push 0x100a865
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov eax, dword [0x102a9d0]
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x604]
mov esi, 0x1001f18
push eax
mov dword [ebp - 0x604], 3
mov dword [ebp - 0x600], 0x100b951
mov dword [ebp - 0x5fc], edi
mov dword [ebp - 0x5f8], 8
mov dword [ebp - 0x5f0], edi
mov dword [ebp - 0x5ec], edi
mov dword [ebp - 0x5e8], 6
mov dword [ebp - 0x5e4], edi
mov dword [ebp - 0x5e0], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x100c8e8
mov ebx, dword [ebp - 0x5dc]
push ebx
push dword [0x102a9d0]
push edi
push edi
push edi
push edi
push edi
push edi
push bind
push edi
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [ebx + 0x7b0], eax
je 0x100c8e8
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [0x1025d1c], eax
jne 0x100c94b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100c94d
call fcn.0100b37b
push 0
jmp 0x100c945
push 0x200
lea eax, [ebp - 0x438]
push eax
push 0x126
push dword [0x102a9d0]
xor edi, edi
mov dword [ebp - 0x5d8], edi
call esi
push edi
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x438]
push eax
push dword [0x1025d18]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push edi
call dword [sym.imp.msvcrt.dll_exit]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100cdd8
leave
ret 0xc