Function at 0x107f46f
Capabilities:
Create thread
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10de03c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], CompareStringW
call fcn.01021462
movsx esi, word [eax + reloc.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
imul esi, esi, reloc.KERNEL32.dll_GetTapeParameters
mov edi, 0x10e6af0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call fcn.01077d26
push eax
call fcn.01077c3f
test ax, ax
je 0x107f527
cmp word [ebp + 0xc], bx
je 0x107f527
call fcn.0104ed4f
call fcn.01078a36
lea eax, [ebp - 0x224]
push eax
call fcn.0107aa61
lea eax, [ebp - 0x224]
push eax
call fcn.0107a62c
push eax
call fcn.0107e7fd
cmp eax, ebx
je 0x107f516
add eax, 0x14
push eax
call fcn.01077cfc
mov dword [ebp - 0x230], 1
lea eax, [ebp - 0x214]
push eax
call fcn.01077d26
call fcn.01078acf
lea eax, [ebp - 0x214]
push eax
call fcn.01077c3f
test ax, ax
jne 0x107f56a
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
push 0x1010318
lea eax, [ebp - 0x204]
push eax
call fcn.0107d959
or edi, 0xffffffff
cmp eax, edi
mov dword [0x10e6c1c], eax
jne 0x107f579
call fcn.0104edc4
mov eax, 0x4c7
jmp 0x107f717
call fcn.0104ed4f
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push 0x107ac4d
push ebx
push ebx
mov dword [0x10e6be8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x10e6c14], eax
je 0x107f639
mov dword [ebp - 0x22c], ebx
jmp 0x107f61f
inc dword [ebp - 0x22c]
cmp dword [ebp - 0x22c], 0x4b0
jl 0x107f5c6
call fcn.0104ed25
cmp dword [0x10e6c08], ebx
jne 0x107f5df
mov eax, esi
dec esi
test eax, eax
jg 0x107f5df
mov dword [ebp - 0x228], 1
call fcn.0104e8a8
test eax, eax
je 0x107f5fb
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
jne 0x107f5fb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x107f61a
mov eax, dword [0x10e6c1c]
cmp eax, edi
mov dword [ebp - 0x228], 1
je 0x107f614
push eax
call fcn.010cb2b0
mov dword [0x10e6c1c], edi
call fcn.01075a13
cmp dword [0x10e6be8], edi
je 0x107f5af
push dword [0x10e6c14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10e6c14], ebx
mov eax, dword [0x10e6c1c]
cmp eax, edi
je 0x107f64e
push eax
call fcn.010cb2b0
mov dword [0x10e6c1c], edi
mov esi, dword [0x10e6be8]
mov dword [ebp - 0x22c], esi
call fcn.0104edc4
cmp esi, ebx
jne 0x107f681
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f6ac
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10de044]
call fcn.010cb310
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f69f
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f69f
lea eax, [ebp - 0x214]
push eax
call fcn.0107e74c
cmp esi, ebx
jne 0x107f6da
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
jne 0x107f6da
cmp word [ebp + 8], bx
mov esi, 0x10e6af0
mov edi, 0x10e6b30
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10e6b10
mov edi, 0x10e6b9c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x107f6d5
call fcn.0104ec36
jmp 0x107f6da
call fcn.0104fb9e
cmp dword [0x10e25bc], ebx
mov esi, 0x3e3
jne 0x107f702
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10de044]
call fcn.010cb310
mov dword [ebp - 0x22c], esi
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f711
mov dword [ebp - 0x22c], esi
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075aef
leave
ret 8