Function at 0x10001bbb
Capabilities:
Create thread
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x10019138]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
push 0x410
call fcn.10001ea5
pop ecx
push 5
pop edi
mov dword [esp + 0x10], eax
call fcn.10003351
lea esi, [eax + 0x1388]
cmp esi, edi
jge 0x10001c04
call fcn.10003351
add edi, eax
cmp edi, esi
jg 0x10001bf9
lea ecx, [esp + 0x250]
mov eax, str._d_dgtqxvooqtzudz
push ecx
push eax
mov dword [0x1001b570], eax
call sym.xyxptsvteo.dll_ypagnacmlidrorpk
pop ecx
xor ebx, ebx
pop ecx
test eax, eax
je 0x10001c4c
cmp dword [esp + 0x250], 0xa
jge 0x10001c4c
cmp dword [esp + 0x250], ebx
jle 0x10001c4c
push dword [esp + 0x250]
push ebx
push str.V9onexQlw0aJf9zqEQocSXNVrjXnaMCzbYuvnAj
call fcn.1000a9e0
add esp, 0xc
push ebx
push ebx
push 0x1e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor edi, edi
inc edi
push edi
push edi
push 0x21
push 0x32
call esi
push eax
push 0x31
call esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push edi
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0xffffffffffffffff
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [0x1001b364]
mov eax, dword [0x1001a048]
and eax, dword [0x1001a054]
mov dword [0x1001b570], esi
mov esi, ecx
imul ecx, ecx, 7
imul esi, esi, 5
mov dword [0x1001a048], eax
mov dword [0x1001a050], eax
mov eax, 0x11d
cdq
add esi, 2
idiv esi
add eax, ecx
mov dword [0x1001a040], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, eax, 0x1e
push 0x7f02
push ebx
mov dword [0x1001a054], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, ebx
je 0x10001cf9
fldz
jmp 0x10001cfb
fld1
push 0x1001a044
fstp dword [0x1001b344]
push ebx
lea eax, [esp + 0x28]
push eax
push 0x10001327
push ebx
push ebx
mov dword [esp + 0x44], str.bidyqxlmgedskivduSseXbSXAidDp
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 4
push 0x1000
push 0x104
push ebx
mov dword [0x1001b578], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [str.F767v4w0c4u2CHOuY3bE5LCvQpGIiHXeNbKB4xrrUp], eax
cmp eax, ebx
je 0x10001d52
push 0x41
pop ecx
mov esi, str.V9onexQlw0aJf9zqEQocSXNVrjXnaMCzbYuvnAj
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 0x20c
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.1000a9e0
add esp, 0xc
push 4
call fcn.100039f5
pop ecx
xor ecx, ecx
mov dword [esp + 0x48], eax
mov word [eax + 2], cx
lea eax, [esp + 0x40]
push ebx
push eax
mov dword [esp + 0x4c], ebx
call sym.xyxptsvteo.dll_ilsvztovgctursuw
push dword [esp + 0x50]
call fcn.100033b9
add esp, 0xc
push 0x1388
push dword [0x1001b578]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x10001dcf
cmp eax, 0x102
je 0x10001dc7
cmp eax, 0xffffffff
jne 0x10001dd5
cmp dword [0x1001b578], ebx
jne 0x10001dd5
mov dword [str.F767v4w0c4u2CHOuY3bE5LCvQpGIiHXeNbKB4xrrUp], 0x1001645c
jmp 0x10001dd5
mov dword [0x1001a048], ebx
jmp 0x10001dd5
mov dword [0x1001b578], ebx
push 0x71
push dword [esp + 0x14]
call sym.xyxptsvteo.dll_yfslbsffcfpb
fld dword [0x100164a0]
pop ecx
fstp dword [0x1001a03c]
pop ecx
fild dword [0x1001a040]
inc dword [0x1001a040]
fld dword [0x1001a03c]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fabs
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [0x1001b344]
fadd qword [0x10016498]
fstp dword [0x1001a03c]
fld dword [0x10016490]
fcomp dword [0x1001a03c]
fnstsw ax
test ah, 0x41
je 0x10001dee
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x1001a048]
cmp dword [esp + 0x14], eax
jl 0x10001e58
add eax, 0xffffffe2
jmp 0x10001e5e
imul eax, eax, 0xc2
push 0x1001a054
push str.V9onexQlw0aJf9zqEQocSXNVrjXnaMCzbYuvnAj
mov dword [esp + 0x1c], eax
mov dword [0x1001a054], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x10001e8e
mov esi, str.OPioMmTtCHGs
mov edi, str.V9onexQlw0aJf9zqEQocSXNVrjXnaMCzbYuvnAj
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10001eb0
mov esp, ebp
pop ebp
ret