Function at 0x107f550
Capabilities:
Create thread
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10de03c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], CompareStringW
call fcn.0102150d
movsx esi, word [eax + reloc.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
imul esi, esi, reloc.KERNEL32.dll_GetTapeParameters
mov edi, 0x10e6af0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call fcn.01077df6
push eax
call fcn.01077d0f
test ax, ax
je 0x107f608
cmp word [ebp + 0xc], bx
je 0x107f608
call fcn.0104ed90
call fcn.01078b06
lea eax, [ebp - 0x224]
push eax
call fcn.0107ab31
lea eax, [ebp - 0x224]
push eax
call fcn.0107a6fc
push eax
call fcn.0107e8d6
cmp eax, ebx
je 0x107f5f7
add eax, 0x14
push eax
call fcn.01077dcc
mov dword [ebp - 0x230], 1
lea eax, [ebp - 0x214]
push eax
call fcn.01077df6
call fcn.01078b9f
lea eax, [ebp - 0x214]
push eax
call fcn.01077d0f
test ax, ax
jne 0x107f64b
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
push 0x1010330
lea eax, [ebp - 0x204]
push eax
call fcn.0107da32
or edi, 0xffffffff
cmp eax, edi
mov dword [0x10e6c20], eax
jne 0x107f65a
call fcn.0104ee05
mov eax, 0x4c7
jmp 0x107f800
call fcn.0104ed90
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push 0x107ad1d
push ebx
push ebx
mov dword [0x10e6be8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x10e6c18], eax
je 0x107f722
mov dword [ebp - 0x22c], ebx
jmp 0x107f708
inc dword [ebp - 0x22c]
cmp dword [ebp - 0x22c], 0x4b0
jl 0x107f6a7
call fcn.0104ed66
cmp dword [0x10e6c08], ebx
jne 0x107f6c8
cmp dword [0x10e6c0c], ebx
jne 0x107f6c8
mov eax, esi
dec esi
test eax, eax
jg 0x107f6c8
mov dword [ebp - 0x228], 1
call fcn.0104e8e9
test eax, eax
je 0x107f6e4
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
jne 0x107f6e4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x107f703
mov eax, dword [0x10e6c20]
cmp eax, edi
mov dword [ebp - 0x228], 1
je 0x107f6fd
push eax
call fcn.010cb43e
mov dword [0x10e6c20], edi
call fcn.01075adf
cmp dword [0x10e6be8], edi
je 0x107f690
push dword [0x10e6c18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10e6c18], ebx
mov eax, dword [0x10e6c20]
cmp eax, edi
je 0x107f737
push eax
call fcn.010cb43e
mov dword [0x10e6c20], edi
mov esi, dword [0x10e6be8]
mov dword [ebp - 0x22c], esi
call fcn.0104ee05
cmp esi, ebx
jne 0x107f76a
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f795
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10de044]
call fcn.010cb49e
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f788
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f788
lea eax, [ebp - 0x214]
push eax
call fcn.0107e825
cmp esi, ebx
jne 0x107f7c3
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
jne 0x107f7c3
cmp word [ebp + 8], bx
mov esi, 0x10e6af0
mov edi, 0x10e6b30
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10e6b10
mov edi, 0x10e6b9c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x107f7be
call fcn.0104ec77
jmp 0x107f7c3
call fcn.0104fbdf
cmp dword [0x10e25bc], ebx
mov esi, 0x3e3
jne 0x107f7eb
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10de044]
call fcn.010cb49e
mov dword [ebp - 0x22c], esi
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x107f7fa
mov dword [ebp - 0x22c], esi
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret 8