Function at 0x10001000
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x14
push esi
push edi
call fcn.1006c060
rdtsc
push 0
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, esi
sbb edx, edi
mov dword [esp + 8], eax
or eax, edx
mov dword [esp + 0xc], edx
je 0x10001045
fld qword [0x100da338]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x10]
push 8
push eax
call fcn.10003370
add esp, 0x10
call fcn.1006c310
call fcn.1006c0d0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
fld qword [0x100da350]
sub esp, 8
fstp qword [esp]
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.10003370
add esp, 0x10
call fcn.1006c140
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.GetQueueStatus
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 8], eax
test eax, eax
je 0x100010b6
fld qword [0x100da338]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x10]
push 4
push eax
call fcn.10003370
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.1006c220
push 1
call fcn.10087e65
mov esi, eax
add esp, 4
test esi, esi
je 0x100010e9
fld qword [0x100da338]
sub esp, 8
fstp qword [esp]
push 4
push esi
call fcn.10003370
add esp, 0x10
push esi
call fcn.10087d88
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 8], eax
test eax, eax
je 0x1000111b
fld qword [0x100da348]
sub esp, 8
fstp qword [esp]
lea ecx, [esp + 0x10]
push 4
push ecx
call fcn.10003370
add esp, 0x10
pop edi
pop esi
add esp, 0x14
jmp 0x1006c400
sub esp, 0x130
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
push edi
push 0x11c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.1008e320
add esp, 0xc
xor ebx, ebx
cmp byte [esp + 0x12e], 1
push str.netapi32.dll
sete bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1006c669
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetStatisticsGet
push esi
call edi
push str.NetApiBufferSize
push esi
mov dword [0x101012b0], eax
call edi
push str.NetApiBufferFree
push esi
mov dword [0x101012a8], eax
call edi
cmp dword [0x101012b0], 0
mov dword [0x101012b8], eax
je 0x1006c490
cmp dword [0x101012a8], 0
je 0x1006c490
test eax, eax
jne 0x1006c497
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, str.LanmanWorkstation
test ebx, ebx
jne 0x1006c4a5
mov eax, str.LanmanServer
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push eax
push 0
call dword [0x101012b0]
test eax, eax
jne 0x1006c65e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1006c65e
lea edx, [esp + 0x10]
push edx
push eax
call dword [0x101012a8]
cmp dword [esp + 0x10], 0
jbe 0x1006c669
mov esi, dword [esp + 0xc]
sub esp, 8
test ebx, ebx
je 0x1006c5ee
fld1
fstp qword [esp]
push 8
push esi
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea eax, [esi + 8]
push 8
push eax
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea edi, [esi + 0x18]
push 8
push edi
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea ecx, [esi + 0x10]
push 8
push ecx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
push 8
push edi
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea edx, [esi + 0x20]
push 8
push edx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea eax, [esi + 0x28]
push 8
push eax
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea ecx, [esi + 0x30]
push 8
push ecx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea edx, [esi + 0x38]
push 8
push edx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea eax, [esi + 0x40]
push 8
push eax
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea ecx, [esi + 0x48]
push 8
push ecx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea edx, [esi + 0x50]
push 8
push edx
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
lea eax, [esi + 0x58]
push 8
push eax
call fcn.10003370
fld1
add esp, 8
fstp qword [esp]
push 8
add esi, 0x60
jmp 0x1006c655
fld qword [0x100da338]
fstp qword [esp]
push 4
push esi
call fcn.10003370
fld qword [0x100da338]
add esp, 8
fstp qword [esp]
lea ecx, [esi + 0x28]
push 4
push ecx
call fcn.10003370
fld qword [0x100da338]
add esp, 8
fstp qword [esp]
lea edx, [esi + 0x2c]
push 4
push edx
call fcn.10003370
fld qword [0x100da338]
add esp, 8
fstp qword [esp]
lea eax, [esi + 0x30]
push 4
push eax
call fcn.10003370
fld qword [0x100da338]
add esp, 8
fstp qword [esp]
push 4
add esi, 0x34
push esi
call fcn.10003370
add esp, 0x10
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x101012b8]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10087a66
add esp, 0x130
ret