Function at 0x10026e70
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x958
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x950], eax
push ebx
push ebp
push edi
push 0x800
xor ebx, ebx
lea eax, [esp + 0x15c]
mov edi, ecx
push ebx
push eax
mov dword [esp + 0x18], edi
call fcn.100d4cc0
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 3
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10026ec4
xor eax, eax
xor ecx, ecx
jmp 0x10026ee2
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [esp + 0x30]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], ecx
call ebp
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x1c]
movzx ecx, word [esp + 0x1a]
movzx edx, word [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1c]
push eax
push ecx
push edx
lea eax, [esp + 0x170]
push str._d__d__d__d:_d:_d
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0x20
push esi
lea ecx, [esp + 0x15c]
push ecx
push 0x1012ca84
push 0x1012caa0
call edi
push 0x800
lea edx, [esp + 0x15c]
push 0
push edx
call fcn.100d4cc0
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
call fcn.10026dc0
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], edx
push ecx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], eax
call ebp
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edx, word [esp + 0x1c]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x18]
push edx
movzx edx, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1c]
push edx
push eax
push ecx
lea edx, [esp + 0x170]
push str._d__d__d__d:_d:_d
push edx
call ebx
add esp, 0x20
push esi
lea eax, [esp + 0x15c]
push eax
push 0x1012cabc
push 0x1012caa0
call edi
push 0x800
lea ecx, [esp + 0x15c]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
call fcn.10026d00
push eax
lea edx, [esp + 0x15c]
push 0x1012cad4
push edx
call ebx
add esp, 0xc
push esi
lea eax, [esp + 0x15c]
push eax
push str.BootTime
push 0x1012caa0
call edi
push esi
push 0x101d9e40
push str.EncryptedFile
push 0x1012caa0
call edi
push esi
push 0x101d9c38
push str.OriginFile
push 0x1012caa0
call edi
push 0x118
lea ecx, [esp + 0x40]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push str.MajorVersion
push 0x1012caa0
call edi
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push str.MinorVersion
push 0x1012caa0
call edi
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push str.PlatformId
push 0x1012caa0
call edi
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push str.BuildNumber
push 0x1012caa0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetCurrentProcessorNumber
push 0x1012a18c
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
lea eax, [esp + 0x15c]
push 0x1012cad4
push eax
call ebx
add esp, 0xc
push esi
lea ecx, [esp + 0x15c]
push ecx
push 0x1012cba8
push 0x1012caa0
call edi
push 0x1012cbe4
push 0x1012a18c
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
lea edx, [esp + 0x15c]
push 0x1012cad4
push edx
call ebx
add esp, 0xc
push esi
lea eax, [esp + 0x15c]
push eax
push str.GetCurrentThreadIdBase
push 0x1012caa0
call edi
push str.GetActiveWindow
push str.user32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push 0x1012cc50
push 0x1012caa0
call edi
push str.GetClipboardOwner
push str.user32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
lea eax, [esp + 0x15c]
push 0x1012cad4
push eax
call ebx
add esp, 0xc
push esi
lea ecx, [esp + 0x15c]
push ecx
push str.GetClipboardOwnerBase
push 0x1012caa0
call edi
push str.GetCurrentProcessorNumber
push 0x1012a18c
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1012a18c
mov dword [esp + 0x10], eax
call ebp
mov ecx, dword [esp + 0xc]
sub ecx, eax
push ecx
lea edx, [esp + 0x15c]
push 0x1012cad4
push edx
call ebx
add esp, 0xc
push esi
lea eax, [esp + 0x15c]
push eax
push 0x1012ccb8
push 0x1012caa0
call edi
push 0x1012cbe4
push 0x1012a18c
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1012a18c
mov dword [esp + 0x10], eax
call ebp
mov ecx, dword [esp + 0xc]
sub ecx, eax
push ecx
lea ecx, [esp + 0x15c]
push 0x1012cad4
push ecx
call ebx
add esp, 0xc
push esi
lea edx, [esp + 0x15c]
push edx
push 0x1012ccf8
push 0x1012caa0
call edi
push str.GetActiveWindow
push str.user32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.user32.dll
mov dword [esp + 0x10], eax
call ebp
mov ecx, dword [esp + 0xc]
sub ecx, eax
push ecx
lea eax, [esp + 0x15c]
push 0x1012cad4
push eax
call ebx
add esp, 0xc
push esi
lea ecx, [esp + 0x15c]
push ecx
push 0x1012cd2c
push 0x1012caa0
call edi
push str.GetClipboardOwner
push str.user32.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.user32.dll
mov dword [esp + 0x10], eax
call ebp
mov ecx, dword [esp + 0xc]
sub ecx, eax
push ecx
lea edx, [esp + 0x15c]
push 0x1012cad4
push edx
call ebx
add esp, 0xc
push esi
lea eax, [esp + 0x15c]
push eax
push 0x1012cd58
push 0x1012caa0
call edi
mov ecx, dword [esp + 0x95c]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100d0738
add esp, 0x958
ret