Function at 0x100126b0
Capabilities:
Connect pipe
Create directory
Get common file path
Get disk information
Get file size
Identify system language via api
Print debug messages
Set console window title
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093e30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x350
mov byte [0x100fb72c], 1
cmp dword [ebp + 0xc], 1
jne 0x10012cf9
mov dword [0x100fb724], 0x3d68a3b6
movzx eax, byte [0x10097b98]
test eax, eax
je 0x10012cf4
push 0x25a
push 0x10010610
lea ecx, [ebp - 0x84]
push ecx
call fcn.10018c30
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10019020
add esp, 8
cmp dword [0x100fb724], 0x4d79b838
jne 0x100128b6
push 0
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PtVisible]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
push 0
push 0x101069a8
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Escape]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
push 0
call dword [sym.imp.GDI32.dll_GetSystemPaletteUse]
push 0
call dword [sym.imp.KERNEL32.dll_WakeConditionVariable]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetViewportOrgEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
push 0
push 0
push 0
push 0
push 0x101069c4
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumMetaFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
push 0x28e
push 0x10009a50
lea ecx, [ebp - 0x8c]
push ecx
call fcn.10018c30
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10019020
add esp, 8
mov dword [ebp - 0x10], 0x1628
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x1b7b
mov dword [ebp - 0x14], 0x257b
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], 0x1c40
mov dword [ebp - 0x1c], 0x13d3
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], 0
jmp 0x1001292c
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x61
jge 0x1001293d
mov ecx, dword [ebp - 0x28]
add ecx, 8
mov dword [ebp - 0x28], ecx
jmp 0x10012923
mov edx, dword [ebp - 0x10]
sub edx, 0x195d
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0x2421
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x1898
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0xf5e
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x210a
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100129c3
mov edx, dword [ebp - 0x18]
add edx, 0x115d
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 0x4e3
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x191c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], 0
jmp 0x100129ec
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xb
jge 0x100129fd
mov eax, dword [ebp - 0x20]
add eax, 9
mov dword [ebp - 0x20], eax
jmp 0x100129e3
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x24a0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x30], 0x1aca
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1742
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, 0xc08
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x1df0
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
sub eax, 0xb97
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x80000001
jns 0x10012ac3
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10012ad2
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10012ab3
mov eax, dword [ebp - 0x18]
sub eax, 0x11d4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1027
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x20a1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x94e
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x3c], 0
jmp 0x10012b24
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x19
jge 0x10012b35
mov ecx, dword [ebp - 0x20]
add ecx, 7
mov dword [ebp - 0x20], ecx
jmp 0x10012b1b
mov edx, dword [ebp - 0x1c]
add edx, 0x1b84
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x109a
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x141d
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
sub eax, 0xb43
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x16f5
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x6c9
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x2398
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x175c
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x1cca
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xfb8
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x25ee
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2570
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
and eax, 0x80000001
jns 0x10012c2a
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10012c39
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x10012c1b
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x10012c51
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10012c63
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xa97
mov dword [ebp - 0x2c], ecx
jmp 0x10012c6f
mov edx, dword [ebp - 0x2c]
add edx, 0xa97
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0
jmp 0x10012c8a
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x16
jge 0x10012c9b
mov edx, dword [ebp - 0x18]
add edx, 8
mov dword [ebp - 0x18], edx
jmp 0x10012c81
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10012cc1
mov edx, dword [ebp - 0x10]
sub edx, 0x12ed
mov dword [ebp - 0x10], edx
jmp 0x10012ccc
mov eax, dword [ebp - 0x10]
add eax, 0x12ed
mov dword [ebp - 0x10], eax
push 0x268
push 0x1000ef20
lea ecx, [ebp - 0x94]
push ecx
call fcn.10018c30
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10019020
add esp, 8
jmp 0x10013017
cmp dword [ebp + 0xc], 2
jne 0x10013017
lea ecx, [ebp - 0x35c]
push ecx
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1001300c
lea edx, [ebp - 0x35c]
push edx
lea ecx, [ebp - 0x7c]
call fcn.10014cd0
mov dword [ebp - 4], 0
push 0x101069f4
lea ecx, [ebp - 0x7c]
call fcn.10014c90
push 1
push 0x40
push 1
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x154]
call fcn.10013390
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x154]
call fcn.10013310
movzx ecx, al
test ecx, ecx
je 0x10012fbd
lea ecx, [ebp - 0x64]
call fcn.100150b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.100199c0
add esp, 8
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x44]
add ecx, dword [edx + 4]
call fcn.10002af0
movzx eax, al
test eax, eax
je 0x10012fa4
push 0
push 0x10106a28
lea ecx, [ebp - 0x64]
call fcn.10014d40
cmp eax, 0xffffffff
je 0x10012f9f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
push 0
push 0x10106a44
push 0
push 0x10106a7c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNLSString]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0x10106aac
push 0
push 0
push 0x10106ae4
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x10012fa4
jmp 0x10012d7e
lea ecx, [ebp - 0x154]
call fcn.100132e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.10014e90
jmp 0x10012fec
push 0x10106b10
push 0x257
mov ecx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.10018c30
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.100199f0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.100132b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.10014cb0
jmp 0x10013017
push 0x10106b20
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x100fb724], 0x45a5f2ba
jne 0x10013298
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
push 0
push 0
push 0x10106b30
push 0
push 0x10106b5c
push 0
push 0x10106b84
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
push 0
push 0
push 0x10106bbc
push 0
push 0
push 0x10106bec
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
push 0
push 0
push 0
push 0
push 0x10106c0c
push 0
push 0x10106c40
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
push 0
push 0x10106c74
push 0
push 0x10106ca8
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
push 0x10106cd8
push 0x10106cfc
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
push 0
push 0
push 0x10106d24
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
push 0
push 0x10106d60
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
movzx eax, byte [0x100fb72c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc