Function at 0x10005840
Capabilities:
Check for debugger via api
Connect pipe
Copy file
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get geographical location
Get system information on windows
Get uefi variable
Move file
Read pipe
Set console window title
Set current directory
Set environment variable
Set file attributes
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dd9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x47c
call fcn.10003720
push 0x1006a19c
lea ecx, [ebp - 0x78]
call fcn.1000d120
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
push eax
call fcn.10005740
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.1000d050
cmp dword [0x1003fb04], 0x7825249
jne 0x10005a71
push 0
push 0
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontData]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
push 0
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
call dword [sym.imp.GDI32.dll_GetTextCharset]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutW]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
push 0x1006a1b0
push 0
push 0x1006a1d4
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
push 0
call dword [sym.imp.GDI32.dll_GetDCPenColor]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
push 0
push 0
call dword [sym.imp.GDI32.dll_EqualRgn]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBits]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x280]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jbe 0x10005ac3
cmp dword [ebp - 0x44], 0x104
jae 0x10005ac3
lea edx, [ebp - 0x488]
push edx
push 0
push 0x1006a1fc
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10005ac3
lea ecx, [ebp - 0x488]
push ecx
call fcn.1000aad0
add esp, 4
push 0x65ef9316
push 0x85046c54
push 0xc9495653
call fcn.100053c0
add esp, 0xc
mov edx, dword [0x1003fb04]
xor eax, eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x58], 0xf2e7c1b4
jne 0x10005d5b
cmp dword [ebp - 0x54], 0
jne 0x10005d5b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 0
push 0x1006a208
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayMetaFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumObjects]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextStreamW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FillRgn]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthFloatW]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x48], ecx
push 0
mov edx, dword [ebp - 0x48]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push 0
push 0
push 0
push 0
push 0x1006a230
push 0
push 0x1006a258
push 0
push 0x1006a27c
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov eax, dword [ebp - 0x4c]
push eax
call fcn.10005040
add esp, 4
mov dword [ebp - 0x60], eax
mov ecx, 4
imul edx, ecx, 0x37
mov eax, dword [0x10060684]
mov ecx, dword [eax + edx]
add ecx, 4
mov edx, 4
imul eax, edx, 0x37
mov edx, dword [0x10060684]
mov dword [edx + eax], ecx
cmp dword [0x1003fb04], 0x1fa0e6ef
jne 0x10005f66
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1006a2b0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push 0
push 0
push 0x1006a2d0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
call dword [sym.imp.KERNEL32.dll_GetErrorMode]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
push 0
call fcn.10004da0
add esp, 4
mov dword [ebp - 0x2c], 0x398
mov dword [ebp - 0x18], 0x1ac9
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], 0x26a3
mov dword [ebp - 0x1c], 0x1049
mov dword [ebp - 0x20], 0x21d
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1e9b
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1fcf
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x26c6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1ad8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0x1686
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10006013
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x10005ff9
mov eax, dword [ebp - 0x10]
sub eax, 0xe12
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x1000603f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1000604e
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10006030
mov edx, dword [ebp - 0x10]
add edx, 0x1b88
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 0x1186
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x80000001
jns 0x1000607e
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1000608d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1000606e
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x227a
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x16bf
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0xf7d
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x228b
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1f8a
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x11b3
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
add eax, 0x665
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x31
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, 0x1469
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x2500
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x120b
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x13b3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0
jmp 0x100061ca
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0xf
jge 0x100061db
mov edx, dword [ebp - 0x30]
add edx, 2
mov dword [ebp - 0x30], edx
jmp 0x100061c1
mov eax, dword [ebp - 0x20]
add eax, 0x80a
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x157e
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
sub eax, 0xa3d
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0xde8
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1286
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x15d3
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x20e9
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, 0x22e9
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], 0
jmp 0x100062b6
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0x50
jge 0x100062c7
mov eax, dword [ebp - 0x30]
sub eax, 7
mov dword [ebp - 0x30], eax
jmp 0x100062ad
mov ecx, dword [ebp - 0x24]
sub ecx, 0x1731
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x3c], 0
jmp 0x100062ee
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x26
jge 0x100062ff
mov ecx, dword [ebp - 0x30]
add ecx, 4
mov dword [ebp - 0x30], ecx
jmp 0x100062e5
mov edx, dword [ebp - 0x14]
add edx, 0x153a
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x33c
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
add eax, 0x52b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0
jmp 0x10006361
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x3d
jge 0x10006372
mov edx, dword [ebp - 0x2c]
add edx, 2
mov dword [ebp - 0x2c], edx
jmp 0x10006358
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x19af
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1958
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x80
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x1936
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x508
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
add eax, 0x53a
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x2346
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x24a1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0x80000001
jns 0x10006443
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10006452
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10006433
mov eax, dword [ebp - 0x1c]
add eax, 0x23e9
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x2684
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
add eax, 0x1744
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x18fb
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x15eb
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x197c
mov dword [ebp - 0x18], eax
push 0
push 0
call fcn.10007280
add esp, 8
mov ecx, 4
imul edx, ecx, 0x37
mov eax, dword [0x10060684]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x50], ecx
call dword [ebp - 0x50]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
push 0
push 0x1006a2f4
push 0
push 0x1006a328
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerClearRequest]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]