Function at 0x1000f140
Capabilities:
Connect pipe
Copy file
Create directory
Delete file
Enumerate files on windows
Get common file path
Get file size
Get geographical location
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Set current directory
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098283
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x364
mov byte [0x1011b2bc], 1
cmp dword [ebp + 0xc], 1
jne 0x1000f809
mov dword [0x1011b2b4], 0x1dd07105
movzx eax, byte [0x100b5b7d]
test eax, eax
je 0x1000f804
push 0x1cc
push 0x1000d320
lea ecx, [ebp - 0x98]
push ecx
call fcn.10015730
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10015b20
add esp, 8
mov ecx, dword [0x1011b2b4]
xor edx, edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x48], 0xac90c4b8
jne 0x1000f34a
cmp dword [ebp - 0x44], 0
jne 0x1000f34a
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.GDI32.dll_CloseFigure]
push 0
push 0
push str.b8fL77BPBXr9IcaM2H56AG1D
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Polyline]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetClipRgn]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push str.t5kq5Ws2ZsCO4UAfbvVL
call dword [sym.imp.KERNEL32.dll_OpenFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FillRgn]
push str.cNzj3C9nd5o4HB2BW
call dword [sym.imp.KERNEL32.dll_AddDllDirectory]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetOutlineTextMetricsW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFlags]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.GDI32.dll_EndPage]
push 0
call dword [sym.imp.GDI32.dll_CreateMetaFileW]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
call dword [sym.imp.GDI32.dll_WidenPath]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0x1db
push 0x10008130
lea edx, [ebp - 0xa0]
push edx
call fcn.10015730
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10015b20
add esp, 8
mov dword [ebp - 0x10], 0x26c0
mov dword [ebp - 0x2c], 0x2173
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x700
mov dword [ebp - 0x18], 0xce0
mov dword [ebp - 0x28], 0x10fa
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0x1f70
mov eax, dword [ebp - 0x2c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000f3d2
mov edx, dword [ebp - 0x2c]
sub edx, 0xd59
mov dword [ebp - 0x2c], edx
jmp 0x1000f3dd
mov eax, dword [ebp - 0x2c]
add eax, 0xd59
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1333
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x28]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000f40a
cmp dword [ebp - 0x28], 0
jle 0x1000f40a
mov edx, dword [ebp - 0x28]
add edx, 0x1570
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], 0x2071
mov eax, dword [ebp - 0x10]
add eax, 0x1aa1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1747
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x2c]
and edx, 0x80000003
jns 0x1000f438
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000f44d
cmp dword [ebp - 0x2c], 0
jle 0x1000f44d
mov eax, dword [ebp - 0x2c]
sub eax, 0xf34
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000f470
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x1000f456
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xe02
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x2667
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, 0xedd
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x374
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1cb3
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x1a03
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x1888
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x201c
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2437
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x17b6
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0
jmp 0x1000f552
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0x13
jge 0x1000f563
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
jmp 0x1000f549
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x1df8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x2369
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x53f
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1abc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x2388
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, 0x1e79
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x2a7
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x153e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
and edx, 0x80000003
jns 0x1000f633
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000f642
mov eax, dword [ebp - 0x2c]
sub eax, 0x1d80
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x45
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1731
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
sub eax, 0xd9b
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
add eax, 0x432
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
add eax, 0x24cc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x129a
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1693
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x968
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x8c
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe0e
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x2236
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0xccf
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x34], 0
jmp 0x1000f73f
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xf
jge 0x1000f750
mov ecx, dword [ebp - 0x20]
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x1000f736
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
add eax, 0x957
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
and eax, 0x80000001
jns 0x1000f785
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1000f794
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x1000f776
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1011
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x633
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x177e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
push 0x26e
push 0x1000bfe0
lea eax, [ebp - 0xa8]
push eax
call fcn.10015730
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10015b20
add esp, 8
jmp 0x1000fbc7
cmp dword [ebp + 0xc], 2
jne 0x1000fbc7
lea eax, [ebp - 0x370]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1000fbbc
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x90]
call fcn.100117d0
mov dword [ebp - 4], 0
push str.HMpvyxkvLARmHqVIZGPdI.txt
lea ecx, [ebp - 0x90]
call fcn.10011790
push 1
push 0x40
push 1
lea edx, [ebp - 0x90]
push edx
lea ecx, [ebp - 0x168]
call fcn.1000fe90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x168]
call fcn.1000fe10
movzx eax, al
test eax, eax
je 0x1000fb6b
lea ecx, [ebp - 0x78]
call fcn.10011bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x168]
push edx
call fcn.100164c0
add esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 4]
mov ecx, edx
call fcn.10002af0
movzx eax, al
test eax, eax
je 0x1000fb52
push 0
push str.dOiMwKMfMCvWvMsznCK
lea ecx, [ebp - 0x78]
call fcn.10011840
cmp eax, 0xffffffff
je 0x1000fb4d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x40], ecx
push 0
mov edx, dword [ebp - 0x40]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [ebp - 0x5c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareType]
push 0
call dword [sym.imp.KERNEL32.dll_WakeConditionVariable]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
call dword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
push 0
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
push str.sRChGMeaiiu2gMaB
push str.oaFfaw2WeY4DHh229
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
jmp 0x1000fb52
jmp 0x1000f897
lea ecx, [ebp - 0x168]
call fcn.1000fde0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x78]
call fcn.10011990
jmp 0x1000fb99
push str.yotdlKOhliTRIflE
push 0x1c0
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
lea ecx, [ebp - 0xb0]
push ecx
call fcn.10015730
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.100164f0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.1000fdb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.100117b0
jmp 0x1000fbc7
push str.YhICNYqZXWqLDdjLDEeujK
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x1011b2b4]
xor edx, edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x50], 0xfa616b45
jne 0x1000fd97
cmp dword [ebp - 0x4c], 0
jne 0x1000fd97
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0x60], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
push 0
push 0
push str.J2Bv6V711Abov2NZO
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
xor eax, eax
lock dec dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, byte [0x1011b2bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc