Function at 0x107e8d6
Capabilities:
Create thread
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x461c
call fcn.01077a20
mov eax, dword [0x10de03c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x4614], esi
mov dword [ebp - 0x4610], edi
mov dword [ebp - 0x460c], edi
mov dword [ebp - 0x4618], 0xff
mov dword [0x10e6be8], 0xffffffff
call fcn.0102150d
movsx ebx, word [eax + 0xad4]
lea eax, [ebp - 0x4618]
imul ebx, ebx, 0x258
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push edi
push 0x1010330
lea eax, [ebp - 0x204]
push eax
call fcn.0107da32
cmp eax, 0xffffffff
mov dword [0x10e6c20], eax
jne 0x107e964
xor eax, eax
jmp 0x107eb79
add esi, 0x28
mov edi, 0x10e6bc4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x461c]
push eax
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push esi
push 0x107b1a4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x10e6c18], eax
je 0x107ea34
cmp dword [0x10e6be8], 0xffffffff
mov dword [ebp - 0x4608], esi
jne 0x107ea22
xor edi, edi
inc edi
inc dword [ebp - 0x4608]
cmp dword [ebp - 0x4608], 0x4b0
jl 0x107e9be
call fcn.0104ed66
cmp dword [0x10e6c08], esi
jne 0x107e9db
cmp dword [0x10e6c0c], esi
jne 0x107e9db
mov eax, ebx
dec ebx
test eax, eax
jg 0x107e9db
mov dword [ebp - 0x460c], edi
call fcn.0104e8e9
test eax, eax
mov eax, dword [0x10e6c20]
je 0x107ea01
cmp word [ebp - 0x460c], si
jne 0x107ea01
cmp eax, 0xffffffff
je 0x107ea01
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x107ea14
push eax
mov dword [ebp - 0x460c], edi
call sub.NTMSAPI.dll_CloseNtmsSession
or dword [0x10e6c20], 0xffffffff
call fcn.01075adf
cmp dword [0x10e6be8], 0xffffffff
je 0x107e9a7
push dword [0x10e6c18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10e6c18], esi
mov eax, dword [0x10e6c20]
cmp eax, 0xffffffff
je 0x107ea4b
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
or dword [0x10e6c20], 0xffffffff
cmp dword [0x10e6be8], esi
jne 0x107eb73
cmp word [ebp - 0x460c], si
je 0x107ea95
push 0x10e6bb4
call fcn.0107e825
call fcn.0101727b
test eax, eax
je 0x107eb73
call fcn.0101727b
push esi
push 0x8023
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x107eb73
push 0x25c
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, esi
pop ecx
mov dword [ebp - 0x4610], eax
je 0x107eb73
mov ebx, dword [ebp - 0x4610]
xor eax, eax
push eax
push 0xe
pop esi
push esi
mov ecx, 0x97
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4608]
push eax
lea eax, [ebp - 0x4604]
push eax
push 0x10e6bb4
push dword [0x10de044]
mov dword [ebp - 0x4608], 0x3e8
call sub.NTMSAPI.dll_EnumerateNtmsObject
test eax, eax
jne 0x107eb2f
cmp dword [ebp - 0x4608], eax
je 0x107eb2f
lea eax, [ebp - 0x784]
push eax
lea eax, [ebp - 0x4604]
push eax
push dword [0x10de044]
mov dword [ebp - 0x784], 0x580
mov dword [ebp - 0x780], esi
call sub.NTMSAPI.dll_GetNtmsObjectInformationW
lea edi, [ebx + 0x24]
lea esi, [ebp - 0x5c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x4614]
mov dword [ebx + 0x10], ebx
add esi, 0x38
lea edi, [ebx + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x14]
mov esi, 0x10e6bb4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x100205c
add ebx, 0x58
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov ebx, dword [ebp - 0x4614]
mov edi, dword [ebp - 0x4610]
pop ecx
pop ecx
add ebx, 0x14
call fcn.0107c2e1
mov eax, dword [ebp - 0x4610]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret 4