Function at 0x100b2d8
Capabilities:
Get session user name
Initialize winsock library
Set environment variable
Terminate process

Disassembly:
sub esp, 0x5f8
mov eax, dword [0x100f6ec]
and dword [esp], 0
mov dword [esp + 0x5f4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp eax, 0x3a4
je 0x100b310
cmp eax, 0x3a8
je 0x100b310
cmp eax, 0x3b4
jbe 0x100b317
cmp eax, 0x3b6
ja 0x100b317
or dword [0x1029a64], 7
push ebx
push ebp
push esi
push edi
push 0xc0
mov ebx, 0x100f710
push ebx
call fcn.01002054
xor esi, esi
xor edi, edi
inc edi
mov dword [0x100f754], edi
mov dword [0x100f74c], esi
mov dword [0x100f748], esi
mov dword [0x100f710], esi
mov dword [0x100f714], esi
call fcn.0100a261
push esi
push 0x10299d0
push 0x1001e9c
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0100c50c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
pop ebp
push ebp
push 0x1026880
push 0x81
push dword [0x10299d0]
call esi
push ebx
call fcn.0100a29d
lea eax, [esp + 0x74]
push eax
push 0x101
mov dword [0x100f730], edi
mov dword [0x100f734], edi
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x100b3cc
push 0x1026880
push 0x10279e0
call fcn.0100a8c8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x100be38
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
sub eax, 0x3a4
mov edi, 0x3ff
je 0x100b401
sub eax, 4
je 0x100b3f2
sub eax, 0xd
je 0x100b401
dec eax
je 0x100b401
push 0x409
jmp 0x100b40f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, edi
or eax, 0x800
jmp 0x100b40e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, edi
or eax, 0x400
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x577
push 0x1028ee0
push 0x8e
push dword [0x10299d0]
call esi
push ebp
push 0x1027360
push 0x8b
push dword [0x10299d0]
call esi
mov edi, 0xfe
push edi
push 0x1027540
push 0x84
push dword [0x10299d0]
call esi
push ebp
push 0x10272c0
push 0x7f
push dword [0x10299d0]
call esi
push ebp
push 0x1026ee0
push 0x80
push dword [0x10299d0]
call esi
mov ebx, 0xff
push ebx
push 0x1025b40
push 0x8a
push dword [0x10299d0]
call esi
push ebp
push 0x1028d00
push 0x8d
push dword [0x10299d0]
call esi
push edi
push 0x1027a80
push 0x87
push dword [0x10299d0]
call esi
push edi
push 0x1025600
push 0xb9
push dword [0x10299d0]
call esi
push ebp
push 0x1027fc0
push 0x384
push dword [0x10299d0]
call esi
push ebp
push 0x10279e0
push 0xb5
push dword [0x10299d0]
call esi
push 0x1ff
push 0x1028900
push 0xfa
push dword [0x10299d0]
call esi
push ebp
push 0x1028860
push 0x387
push dword [0x10299d0]
call esi
push ebp
push 0x1027c80
push 0xfb
push dword [0x10299d0]
call esi
push edi
push 0x1025d40
push 0xfc
push dword [0x10299d0]
call esi
push edi
push 0x1025940
push edi
push dword [0x10299d0]
call esi
push ebp
push 0x1025800
push ebx
push dword [0x10299d0]
call esi
push ebp
push 0x1026a60
push 0x100
push dword [0x10299d0]
call esi
push ebp
push 0x1026f80
push 0x101
push dword [0x10299d0]
call esi
push ebp
push 0x1027400
push 0x102
push dword [0x10299d0]
call esi
push ebp
push 0x1027f20
push 0x385
push dword [0x10299d0]
call esi
push ebp
push 0x1025fe0
push 0x386
push dword [0x10299d0]
call esi
push ebp
push 0x1028da0
push 0x103
push dword [0x10299d0]
call esi
push ebp
push 0x10274a0
push 0x128
push dword [0x10299d0]
call esi
push ebp
push 0x10258a0
push 0x104
push dword [0x10299d0]
call esi
push ebp
push 0x1027740
push 0x105
push dword [0x10299d0]
call esi
push ebp
push 0x1024d60
push 0x106
push dword [0x10299d0]
call esi
push ebp
push 0x1026da0
push 0x108
push dword [0x10299d0]
call esi
push ebp
push 0x1025f40
push 0x109
push dword [0x10299d0]
call esi
push ebp
push 0x1026e40
push 0x10a
push dword [0x10299d0]
call esi
push ebp
push 0x1026d00
push 0x10b
push dword [0x10299d0]
call esi
push ebp
push 0x1027020
push 0x10c
push dword [0x10299d0]
call esi
push ebp
push 0x10269c0
push 0x10d
push dword [0x10299d0]
call esi
push ebp
push 0x1026920
push 0x10e
push dword [0x10299d0]
call esi
push ebx
push 0x1027d20
push 0x10f
push dword [0x10299d0]
call esi
push edi
push 0x10277e0
push 0x110
push dword [0x10299d0]
call esi
push edi
push 0x10270c0
push 0x11c
push dword [0x10299d0]
call esi
push edi
push 0x1026b00
push 0x112
push dword [0x10299d0]
call esi
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a4
jne 0x100b740
mov al, byte [0x1029a64]
test al, 1
je 0x100b740
test al, 2
je 0x100b740
mov ebx, 0x3ff
push ebx
push 0x1024e00
push 0x11d
push dword [0x10299d0]
call esi
push ebx
push 0x1028060
push 0x11e
push dword [0x10299d0]
call esi
push ebx
push 0x1026080
push 0x11f
jmp 0x100b776
mov ebx, 0x3ff
push ebx
push 0x1024e00
push 0x111
push dword [0x10299d0]
call esi
push ebx
push 0x1028060
push 0x113
push dword [0x10299d0]
call esi
push ebx
push 0x1026080
push 0xfd
push dword [0x10299d0]
call esi
push 0x1001e98
push 0x1001e80
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, dword [sym.imp.msvcrt.dll_wcscpy]
push 0x10018d4
push 0x1029a80
call ebx
push 0x10018d4
push 0x102a860
call ebx
add esp, 0x10
cmp dword [esp + 0x60c], 1
jle 0x100bbd3
xor ebx, ebx
inc ebx
cmp dword [esp + 0x60c], ebx
jle 0x100bbd3
mov edx, dword [esp + 0x610]
mov eax, dword [edx + ebx*4]
mov cx, word [eax]
cmp cx, 0x2d
je 0x100b8d9
cmp cx, 0x2f
je 0x100b8d9
cmp dword [esp + 0x10], 0
jne 0x100bddc
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, 0x7e
pop ecx
jae 0x100b821
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
jmp 0x100b824
push 0x7e
pop eax
push eax
mov eax, dword [esp + 0x614]
push dword [eax + ebx*4]
push 0x100f7e8
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [0x100f9e8], 0
add esp, 0xc
inc ebx
cmp ebx, dword [esp + 0x60c]
jge 0x100bbd3
mov eax, dword [esp + 0x610]
mov eax, dword [eax + ebx*4]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x100b889
mov eax, dword [esp + 0x610]
mov eax, dword [eax + ebx*4]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x100b889
dec ebx
jmp 0x100bbbe
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, edi
pop ecx
jae 0x100b8b1
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
jmp 0x100b8b3
mov eax, edi
push eax
mov eax, dword [esp + 0x614]
push dword [eax + ebx*4]
push 0x100f9e8
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
and word [0x100fbe6], 0
jmp 0x100bbbe
movzx ecx, word [eax + 2]
cmp ecx, 0x61
jg 0x100b91d
je 0x100b8ee
sub ecx, 0x41
je 0x100b8ee
sub ecx, 4
jmp 0x100b920
cmp word [eax + 4], 0
jne 0x100b912
lea eax, [esp + 0x14]
push eax
push 0x1029a80
mov dword [esp + 0x1c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x100bbbe
mov word [eax + 2], 0x3f
jmp 0x100b883
sub ecx, 0x65
je 0x100bb9b
dec ecx
je 0x100bacf
sub ecx, 6
je 0x100ba15
sub ecx, 8
jne 0x100bddc
cmp word [eax + 4], 0
jne 0x100b98f
inc ebx
cmp ebx, dword [esp + 0x60c]
jge 0x100ba26
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x18
pop ecx
jae 0x100b97f
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100b982
push 0x18
pop eax
push eax
mov eax, dword [esp + 0x614]
push dword [eax + ebx*4]
jmp 0x100b9c3
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
dec eax
cmp eax, 0x18
pop ecx
jae 0x100b9b1
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
dec eax
jmp 0x100b9b4
push 0x18
pop eax
push eax
mov eax, dword [esp + 0x614]
mov eax, dword [eax + ebx*4]
add eax, 4
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [esp + 0x7c], 0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.010026af
test eax, eax
mov dword [0x102a1d4], eax
jge 0x100bbbe
push 0
lea eax, [esp + 0x18]
push eax
mov esi, 0x10270c0
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push dword [0x1024d10]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100bde1
cmp word [eax + 4], 0
jne 0x100ba7c
inc ebx
cmp ebx, dword [esp + 0x60c]
jl 0x100ba3d
dec ebx
mov eax, dword [edx + ebx*4]
mov word [eax], 0x2d
mov eax, dword [edx + ebx*4]
mov word [eax + 2], 0x3f
jmp 0x100bbc6
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x100
pop ecx
jae 0x100ba6a
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100ba6f
mov eax, 0x100
push eax
mov eax, dword [esp + 0x614]
push dword [eax + ebx*4]
jmp 0x100bab4
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
dec eax
cmp eax, 0x100
pop ecx
jae 0x100baa0
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
dec eax
jmp 0x100baa5
mov eax, 0x100
push eax
mov eax, dword [esp + 0x614]
mov eax, dword [eax + ebx*4]
add eax, 4
push eax
push 0x1029a80
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
and word [0x1029c80], 0
jmp 0x100bbbe
cmp word [eax + 4], 0
jne 0x100bb23
inc ebx
cmp ebx, dword [esp + 0x60c]
jge 0x100ba26
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x105
pop ecx
jae 0x100bb11
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100bb16
mov eax, 0x105
push eax
mov eax, dword [esp + 0x614]
push dword [eax + ebx*4]
jmp 0x100bb67
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
cmp eax, 0x105
pop ecx
jae 0x100bb47
mov eax, dword [esp + 0x610]
push dword [eax + ebx*4]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
inc eax
jmp 0x100bb4c
mov eax, 0x105
push eax
push 0x1001e78
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [esp + 0x614]
mov ecx, dword [ecx + ebx*4]
lea eax, [ecx + eax*2]
push eax
push 0x102a860
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [0x102aa6a], 0
add esp, 0xc
push 0x102a860
call fcn.01002605
test eax, eax
je 0x100bde5
mov dword [0x100f74c], 1
jmp 0x100bbbe
mov ax, word [eax + 4]
test ax, ax
jne 0x100bbb8
inc ebx
cmp ebx, dword [esp + 0x60c]
jge 0x100ba26
mov eax, dword [edx + ebx*4]
mov ax, word [eax]
mov word [0x100e028], ax
mov edx, dword [esp + 0x610]
inc ebx
cmp ebx, dword [esp + 0x60c]
jl 0x100b7d4
push 0x10018d4
mov ebx, 0x1029a80
push ebx
call dword [sym.imp.msvcrt.dll_wcscmp]
pop ecx
xor edi, edi
test eax, eax
pop ecx
je 0x100bc3a
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x100be36
push eax
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
pop ecx
mov dword [0x100fbe8], eax
je 0x100be36
push edi
push edi
push dword [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov al, byte [0x1029a64]
test al, 1
mov dword [0x1024cb8], 0x1025800
mov dword [0x1024cbc], 0x10021c9
mov dword [0x1024cc0], 0x1026a60
mov dword [0x1024cc4], 0x10022bb
mov dword [0x1024cc8], 0x1026f80
mov dword [0x1024ccc], 0x1009aa5
mov dword [0x1024cd0], 0x1027400
mov dword [0x1024cd4], 0x100316f
mov dword [0x1024cd8], 0x1028da0
mov dword [0x1024cdc], 0x1003757
mov dword [0x1024ce0], 0x10274a0
mov dword [0x1024ce4], 0x100382d
mov dword [0x1024ce8], 0x10258a0
mov dword [0x1024cec], 0x1002832
mov dword [0x1024cf0], 0x1027740
mov dword [0x1024cf4], 0x1003789
mov dword [0x1024cf8], 0x1024d60
mov dword [0x1024cfc], 0x1002e0a
je 0x100bd34
test al, 2
je 0x100bd34
mov ebx, 0x100e880
push 0xff
lea eax, [ebx + 8]
push eax
push dword [ebx]
push dword [0x10299d0]
call esi
add ebx, 0x210
cmp ebx, 0x100f6f0
jl 0x100bd00
push ebp
push 0x1028e40
push 0xc3
push dword [0x10299d0]
call esi
push 1
push 0x100a137
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov eax, dword [0x10299d0]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov esi, 0x1001e5c
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x100af3f
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 8
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 6
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x100bdd4
mov ebx, dword [esp + 0x614]
push ebx
push dword [0x10299d0]
push edi
push edi
push edi
push edi
push edi
push edi
push 0x80000000
push edi
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [ebx + 0x7b0], eax
je 0x100bdd4
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [0x1024d14], eax
jne 0x100be36
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100be38
call fcn.0100a9d4
push 0
jmp 0x100be30
push 0x200
lea eax, [esp + 0x208]
push eax
push 0x126
push dword [0x10299d0]
xor edi, edi
mov dword [esp + 0x24], edi
call esi
push edi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
lea eax, [esp + 0x210]
push eax
push dword [0x1024d10]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push edi
call dword [sym.imp.msvcrt.dll_exit]
xor eax, eax
mov ecx, dword [esp + 0x604]
pop edi
pop esi
pop ebp
pop ebx
call fcn.0100c260
add esp, 0x5f8
ret 0xc