Function at 0x101fdd5
Capabilities:
Check os version
Create thread
Delete file
Resolve function by parsing pe exports

Disassembly:
push 0x33c
push 0x1052968
call fcn.0104f228
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x144], edi
call fcn.0101f210
cmp eax, edi
jne 0x102122f
push edi
push edi
push 1
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
cmp ebx, edi
jne 0x101fe2a
push 0xd
pop eax
jmp 0x102122f
mov eax, dword [ebx + 0xc]
cmp eax, edi
jne 0x101fe42
cmp dword [ebx + 8], edi
jne 0x101fe40
mov eax, 0x667
jmp 0x102122f
cmp eax, edi
jbe 0x101fe49
cmp dword [ebx + 8], edi
ja 0x101fe22
mov esi, 0x698
mov eax, dword [ebx + 8]
cmp eax, edi
jbe 0x101fe85
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x134], eax
mov eax, dword [ecx]
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x101fe63
sub eax, edi
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, 0xfffffff8
add ecx, 4
dec dword [ebp - 0x134]
jne 0x101fe5e
xor edi, edi
mov eax, dword [ebx + 0xc]
cmp eax, edi
jbe 0x101feba
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 0x134], eax
mov eax, dword [ecx]
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x101fe9a
sub eax, edi
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, 0xfffffff8
add ecx, 4
dec dword [ebp - 0x134]
jne 0x101fe95
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x101fed9
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fec4
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, 0xfffffff8
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x101fef8
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fee3
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, 0xfffffff8
mov eax, dword [ebx + 0x10]
test eax, eax
jbe 0x101ff2d
mov ecx, dword [ebx + 0x1c]
mov dword [ebp - 0x134], eax
mov eax, dword [ecx]
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x101ff0d
sub eax, edi
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, 0xfffffff8
add ecx, 4
dec dword [ebp - 0x134]
jne 0x101ff08
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x101ff50
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ff37
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
push 0xfffffffffffffff8
pop edi
and esi, edi
jmp 0x101ff53
push 0xfffffffffffffff8
pop edi
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x101ff71
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ff5d
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x101ff8f
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ff7b
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x101ffad
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ff99
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x101ffcb
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ffb7
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x101ffe9
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ffd5
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1020007
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fff3
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x1020025
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1020011
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1020043
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102002f
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1020061
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102004d
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x102007f
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102006b
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x102009d
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1020089
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 9]
and esi, edi
add esi, 0x1e8
push esi
push 8
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10200bf
push 0xe
jmp 0x101fe24
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x10566d8], edi
push 0x10000
push 8
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x348], eax
mov eax, dword [0x10566d8]
cmp dword [eax + 0x348], 0
jne 0x102010f
push edi
push 0
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10200b8
add edi, 0x698
mov dword [ebp - 0x134], edi
push 0x1079a00
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
push 0x148
push 0
push 0x1079a20
call sub.msvcrt.dll_memset
add esp, 0xc
or eax, 0xffffffff
mov dword [0x1079a28], eax
mov dword [0x1079a2c], eax
mov byte [0x1079a58], 0
mov byte [0x1079a59], 0
mov dword [0x1079a50], eax
mov dword [0x1079a54], eax
mov eax, 0x1079ab0
mov dword [0x1079ab4], eax
mov dword [0x1079ab0], eax
mov eax, 0x1079ab8
mov dword [0x1079abc], eax
mov dword [0x1079ab8], eax
mov eax, 0x1079ac0
mov dword [0x1079ac4], eax
mov dword [0x1079ac0], eax
mov eax, 0x1079ac8
mov dword [0x1079acc], eax
mov dword [0x1079ac8], eax
mov eax, 0x1079ad0
mov dword [0x1079ad4], eax
mov dword [0x1079ad0], eax
mov eax, 0x1079ad8
mov dword [0x1079adc], eax
mov dword [0x1079ad8], eax
mov eax, 0x1079ae0
mov dword [0x1079ae4], eax
mov dword [0x1079ae0], eax
mov eax, 0x1079ae8
mov dword [0x1079aec], eax
mov dword [0x1079ae8], eax
mov eax, 0x1079af0
mov dword [0x1079af4], eax
mov dword [0x1079af0], eax
mov eax, 0x1079af8
mov dword [0x1079afc], eax
mov dword [0x1079af8], eax
mov eax, 0x1079b00
mov dword [0x1079b04], eax
mov dword [0x1079b00], eax
mov eax, 0x1079b08
mov dword [0x1079b0c], eax
mov dword [0x1079b08], eax
mov eax, 0x1079b14
mov dword [0x1079b18], eax
mov dword [0x1079b14], eax
mov eax, 0x1079b1c
mov dword [0x1079b20], eax
mov dword [0x1079b1c], eax
mov eax, 0x1079b24
mov dword [0x1079b28], eax
mov dword [0x1079b24], eax
mov eax, 0x1079b2c
mov dword [0x1079b30], eax
mov dword [0x1079b2c], eax
mov eax, 0x1079b3c
mov dword [0x1079b40], eax
mov dword [0x1079b3c], eax
mov eax, 0x1079b34
mov dword [0x1079b38], eax
mov dword [0x1079b34], eax
mov eax, 0x1079b44
mov dword [0x1079b48], eax
mov dword [0x1079b44], eax
mov eax, 0x1079b4c
mov dword [0x1079b50], eax
mov dword [0x1079b4c], eax
test byte [ebx + 0x78], 8
je 0x10203bf
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x34c]
push eax
push ebx
call fcn.0101f37d
mov dword [ebp - 0x134], eax
test eax, eax
je 0x10203df
xor edi, edi
cmp dword [ebp - 0x134], edi
je 0x1021229
mov dword [ebp - 4], edi
push 0x1079a00
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push dword [0x10566d8]
call fcn.0102515e
mov eax, dword [0x10566d8]
add eax, 0x39c
cmp dword [eax], edi
je 0x1020301
push dword [eax]
call fcn.01023fb3
mov eax, dword [0x10566d8]
add eax, 0x68c
cmp dword [eax], edi
je 0x1020316
push dword [eax]
call sub.wevtapi.dll_EvtClose
cmp dword [ebp - 0x148], edi
je 0x1020323
call fcn.010237d6
mov eax, dword [0x1079aa0]
cmp eax, edi
je 0x102033a
push eax
push edi
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1079a70]
cmp eax, edi
je 0x102035d
push eax
call dword [sym.imp.msvcrt.dll_fclose]
mov dword [0x1079a70], edi
mov dword [esp], 0x10566e8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x1079a74]
cmp eax, edi
je 0x1020380
push eax
call dword [sym.imp.msvcrt.dll_fclose]
mov dword [0x1079a74], edi
mov dword [esp], 0x1056ee8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x10566d8]
cmp eax, edi
je 0x1021222
add eax, 0x684
cmp dword [eax], edi
je 0x102039d
push dword [eax]
call fcn.0103b312
mov eax, dword [0x10566d8]
cmp eax, edi
je 0x10203b4
push eax
push edi
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10566d8], edi
jmp 0x1021222
mov eax, dword [ebx + 8]
test eax, eax
jbe 0x10203d9
mov esi, dword [ebx + 0x14]
mov ecx, eax
lea edi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x134]
mov dword [ebp - 0x140], eax
xor esi, esi
cmp dword [ebp - 0x138], esi
jbe 0x102041e
test byte [ebx + 0x78], 8
jne 0x10203fe
mov dword [ebp - 0x134], 0xa0
jmp 0x10202c5
push dword [ebp - 0x138]
lea eax, [ebp - 0x34c]
push eax
call fcn.0103b9df
mov dword [ebp - 0x134], eax
cmp eax, esi
jne 0x10202c5
mov eax, 0x3c0
mov ecx, dword [0x10566d8]
or dword [eax + ecx], 0xffffffff
mov ecx, dword [0x10566d8]
mov dword [eax + ecx + 4], esi
add eax, 8
cmp eax, 0x5c0
jb 0x1020423
cmp dword [ebp - 0x140], esi
jbe 0x10204e1
push 0x10
pop esi
lea eax, [ebp - 0x24c]
sub eax, esi
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x138], eax
mov eax, dword [0x10566d8]
mov dword [esi + eax], edi
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + esi]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x13c], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1020486
sub eax, dword [ebp - 0x13c]
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [esi + eax]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [esi + eax]
lea edx, [ecx + 2]
mov dword [ebp - 0x13c], edx
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x10204b9
sub ecx, dword [ebp - 0x13c]
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
add esi, 4
dec dword [ebp - 0x138]
jne 0x102046f
jmp 0x10204e6
mov eax, dword [0x10566d8]
and dword [ebp - 0x134], 0
cmp dword [ebx + 0xc], 0
jbe 0x1020588
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x134]
add ecx, edx
lea esi, [ecx*4 + 0x110]
mov dword [esi + eax], edi
mov ecx, edx
shl ecx, 2
mov eax, dword [ebx + 0x18]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x138], eax
lea edx, [eax + 2]
mov dword [ebp - 0x13c], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1020526
sub eax, dword [ebp - 0x13c]
sar eax, 1
push dword [ebp - 0x138]
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [ecx + eax + 0x110]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [esi + eax]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x102055c
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
inc dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebx + 0xc]
jb 0x10204f7
cmp dword [ebx + 0x24], 0
je 0x10205e2
mov dword [eax + 0x314], edi
mov ecx, dword [ebx + 0x24]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x102059c
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x314]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x314]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x10205cb
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x2c], 0
je 0x102063c
mov dword [eax + 0x318], edi
mov ecx, dword [ebx + 0x2c]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10205f6
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x318]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x318]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020625
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x30], 0
je 0x1020696
mov dword [eax + 0x31c], edi
mov ecx, dword [ebx + 0x30]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020650
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x31c]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x31c]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x102067f
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
and dword [ebp - 0x134], 0
cmp dword [ebx + 0x10], 0
jbe 0x1020722
mov esi, 0x210
mov dword [esi + eax], edi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [esi + eax - 0x210]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x13c], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10206c0
sub eax, dword [ebp - 0x13c]
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [esi + eax]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [esi + eax]
lea edx, [ecx + 2]
mov dword [ebp - 0x13c], edx
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x10206f3
sub ecx, dword [ebp - 0x13c]
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
inc dword [ebp - 0x134]
add esi, 4
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebx + 0x10]
jb 0x10206a8
cmp dword [ebx + 0x34], 0
je 0x102077c
mov dword [eax + 0x328], edi
mov ecx, dword [ebx + 0x34]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020736
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x328]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x328]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020765
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x20], 0
je 0x10207d6
mov dword [eax + 0x32c], edi
mov ecx, dword [ebx + 0x20]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020790
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x32c]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x32c]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x10207bf
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x38], 0
je 0x1020830
mov dword [eax + 0x334], edi
mov ecx, dword [ebx + 0x38]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10207ea
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x334]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x334]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020819
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x28], 0
je 0x102088a
mov dword [eax + 0x330], edi
mov ecx, dword [ebx + 0x28]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020844
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x330]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x330]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020873
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x3c], 0
je 0x10208e4
mov dword [eax + 0x320], edi
mov ecx, dword [ebx + 0x3c]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x102089e
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x320]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x320]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x10208cd
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x40], 0
je 0x102093e
mov dword [eax + 0x324], edi
mov ecx, dword [ebx + 0x40]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10208f8
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x324]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x324]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020927
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x44], 0
je 0x1020998
mov dword [eax + 0x338], edi
mov ecx, dword [ebx + 0x44]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020952
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x338]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x338]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020981
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x48], 0
je 0x10209f2
mov dword [eax + 0x33c], edi
mov ecx, dword [ebx + 0x48]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10209ac
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x33c]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x33c]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x10209db
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x4c], 0
je 0x1020a4c
mov dword [eax + 0x340], edi
mov ecx, dword [ebx + 0x4c]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020a06
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x340]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x340]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020a35
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x50], 0
je 0x1020aa6
mov dword [eax + 0x344], edi
mov ecx, dword [ebx + 0x50]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020a60
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x344]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x344]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020a8f
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
cmp dword [ebx + 0x54], 0
je 0x1020b00
mov dword [eax + 0x34c], edi
mov ecx, dword [ebx + 0x54]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1020aba
sub eax, edx
sar eax, 1
push ecx
inc eax
push eax
mov eax, dword [0x10566d8]
push dword [eax + 0x34c]
call fcn.0101f55e
mov eax, dword [0x10566d8]
mov ecx, dword [eax + 0x34c]
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1020ae9
sub ecx, edx
sar ecx, 1
lea ecx, [ecx + ecx + 9]
and ecx, 0xfffffff8
add edi, ecx
mov ecx, dword [ebp - 0x140]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [0x10566d8]
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x10]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x58]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3a0], eax
mov eax, dword [ebx + 0x5c]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3a4], eax
mov eax, dword [ebx + 0x60]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3a8], eax
mov eax, dword [ebx + 0x64]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3ac], eax
mov eax, dword [ebx + 0x78]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3b0], eax
mov eax, dword [ebx + 4]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x398], eax
mov eax, dword [ebx + 0x80]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x5c0], eax
mov eax, dword [ebx + 0x84]
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x688], eax
xor esi, esi
mov dword [ebp - 0x138], esi
mov ecx, dword [0x10566d8]
lea eax, [ecx + 0x338]
cmp dword [eax], esi
je 0x1020be3
mov eax, dword [eax]
cdq
mov dword [ecx + 0x358], eax
mov eax, dword [0x10566d8]
mov dword [eax + 0x35c], edx
mov eax, dword [0x10566d8]
and dword [eax + 0x360], esi
inc esi
mov dword [ebp - 0x138], esi
mov ecx, dword [0x10566d8]
lea eax, [ecx + 0x33c]
cmp dword [eax], 0
je 0x1020c27
mov eax, dword [eax]
cdq
shl esi, 4
mov dword [esi + ecx + 0x358], eax
mov eax, dword [0x10566d8]
mov dword [esi + eax + 0x35c], edx
mov esi, dword [ebp - 0x138]
lea eax, [esi + 0x36]
shl eax, 4
mov ecx, dword [0x10566d8]
mov dword [eax + ecx], 1
inc esi
mov ecx, dword [0x10566d8]
lea eax, [ecx + 0x340]
cmp dword [eax], 0
je 0x1020c4b
push dword [ecx + 0x344]
push dword [eax]
push dword [ecx + 0x33c]
call fcn.0104f4af
mov ecx, dword [0x10566d8]
test dword [ecx + 0x3b0], 0x800000
je 0x1020c8f
mov eax, esi
shl eax, 4
mov dword [eax + ecx + 0x358], 1
mov ecx, dword [0x10566d8]
and dword [eax + ecx + 0x35c], 0
lea eax, [esi + 0x36]
shl eax, 4
mov ecx, dword [0x10566d8]
mov dword [eax + ecx], 2
inc esi
mov ecx, dword [0x10566d8]
mov eax, esi
shl eax, 4
mov dword [eax + ecx + 0x358], 4
mov ecx, dword [0x10566d8]
and dword [eax + ecx + 0x35c], 0
lea eax, [esi + 0x36]
shl eax, 4
mov ecx, dword [0x10566d8]
mov dword [eax + ecx], 3
inc esi
mov eax, dword [0x10566d8]
mov dword [eax + 0x350], esi
mov eax, edi
mov dword [0x1079aac], eax
mov esi, pe_nt_image_headers32
add edi, esi
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov ecx, dword [0x1079aac]
add ecx, eax
mov dword [ecx + 4], ecx
mov ecx, dword [0x1079aac]
add ecx, eax
mov edx, dword [ecx + 4]
mov dword [ecx], edx
add eax, 8
cmp eax, esi
jb 0x1020ce8
mov dword [0x1079b10], edi
mov esi, 0x100
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, dword [0x1079b10]
add eax, ecx
mov dword [eax + 4], eax
mov eax, dword [0x1079b10]
add eax, ecx
mov edx, dword [eax + 4]
mov dword [eax], edx
add ecx, 8
cmp ecx, esi
jb 0x1020d20
xor esi, esi
test byte [ebx + 0x78], 0x80
je 0x1020d59
cmp dword [ebx + 0x2c], esi
je 0x1020d59
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], 0x80
mov edx, 0x400
test dword [ebx + 0x78], edx
je 0x1020d73
cmp dword [ebx + 0x28], esi
je 0x1020d73
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], edx
mov ecx, 0x800
test dword [ebx + 0x78], ecx
je 0x1020d8d
cmp dword [ebx + 0x38], esi
je 0x1020d8d
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x80000
test dword [ebx + 0x78], ecx
je 0x1020da7
cmp dword [ebx + 0x44], esi
je 0x1020da7
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x100000
test dword [ebx + 0x78], ecx
je 0x1020dc1
cmp dword [ebx + 0x48], esi
je 0x1020dc1
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x200000
test dword [ebx + 0x78], ecx
je 0x1020ddb
cmp dword [ebx + 0x4c], esi
je 0x1020ddb
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x400000
test dword [ebx + 0x78], ecx
je 0x1020df5
cmp dword [ebx + 0x50], esi
je 0x1020df5
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov eax, dword [ebx + 0x78]
mov ecx, 0x4000000
test ecx, eax
je 0x1020e15
test al, 8
je 0x1020e15
cmp dword [ebx + 0x30], esi
je 0x1020e15
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x40000000
test dword [ebx + 0x78], ecx
je 0x1020e2f
cmp dword [ebx + 0x10], esi
je 0x1020e2f
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
push edx
push 0x10566e8
call fcn.01022d0c
mov dword [ebp - 0x134], eax
cmp eax, esi
jne 0x10202c5
mov edi, 0x10021e8
push edi
push 0x10566e8
mov esi, dword [sym.imp.msvcrt.dll__wfopen]
call esi
pop ecx
pop ecx
mov dword [0x1079a70], eax
test eax, eax
jne 0x1020e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x10202c5
push 0x400
push 0x1056ee8
call fcn.01022d0c
mov dword [ebp - 0x134], eax
test eax, eax
jne 0x10202c5
push edi
push 0x1056ee8
call esi
pop ecx
pop ecx
mov dword [0x1079a74], eax
test eax, eax
jne 0x1020ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x134], eax
xor edi, edi
cmp dword [ebp - 0x134], edi
jne 0x10202d3
mov byte [0x1079a78], 0
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], 0x200
test byte [ebx + 0x78], 8
je 0x1020f00
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], 8
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], 0x8000
mov ecx, 0x40000
test dword [ebx + 0x78], ecx
je 0x1020f15
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x1000000
test dword [ebx + 0x78], ecx
je 0x1020f2a
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x2000000
test dword [ebx + 0x78], ecx
je 0x1020f3f
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x8000000
test dword [ebx + 0x78], ecx
je 0x1020f54
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x10000000
test dword [ebx + 0x78], ecx
je 0x1020f69
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov ecx, 0x20000000
test dword [ebx + 0x78], ecx
je 0x1020f7e
mov eax, dword [0x10566d8]
or dword [eax + 0x3b0], ecx
mov eax, dword [ebx + 0x7c]
cmp eax, edi
je 0x1020f91
mov ecx, dword [0x10566d8]
mov dword [ecx + 0x3b4], eax
mov dword [ebp - 0x130], 0x114
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1021040
cmp dword [ebp - 0x12c], 5
ja 0x1020fc8
jne 0x1021040
cmp dword [ebp - 0x128], 1
jb 0x1021040
mov byte [0x10566dc], 1
push 0x10021d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1079a1c], eax
cmp eax, edi
je 0x1021040
push 0x10021bc
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
push eax
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
call esi
mov dword [0x10576e8], eax
push 0x10021a4
push dword [0x1079a1c]
call edi
push eax
call esi
mov dword [0x10576ec], eax
push 0x100218c
push dword [0x1079a1c]
call edi
push eax
call esi
mov dword [0x10576f0], eax
push 0x1002174
push dword [0x1079a1c]
call edi
push eax
call esi
mov dword [0x10576f4], eax
xor edi, edi
mov dword [ebp - 0x148], 1
push dword [0x10566d8]
call fcn.01025078
mov dword [ebp - 0x134], eax
cmp eax, edi
jne 0x10202c7
mov eax, dword [0x10566d8]
test dword [eax + 0x3b0], 0x4000000
je 0x102109c
push dword [eax + 0x31c]
call fcn.01047bfa
mov dword [0x1079b5c], eax
cmp eax, edi
jne 0x1021097
mov dword [ebp - 0x134], 0x3aa0
jmp 0x10202c7
mov eax, dword [0x10566d8]
test dword [eax + 0x3b0], 0x40000000
je 0x10210ce
xor esi, esi
cmp dword [ebx + 0x10], edi
jbe 0x10210ce
mov eax, dword [ebx + 0x1c]
push dword [eax + esi*4]
call sub.tdh.dll_TdhLoadManifest
mov dword [ebp - 0x134], eax
cmp eax, edi
jne 0x10202c7
inc esi
cmp esi, dword [ebx + 0x10]
jb 0x10210af
call fcn.0101f18e
test eax, eax
jne 0x10210ee
call dword [sym.imp.WS2_32.dll_WSACleanup]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x134], eax
jmp 0x10202c7
mov eax, dword [0x10566d8]
cmp byte [eax + 0x5d0], 0
je 0x1021149
mov ecx, dword [0x1079a4c]
mov edx, dword [0x1079a54]
cmp ecx, edx
ja 0x1021149
jb 0x102111c
mov esi, dword [0x1079a48]
cmp esi, dword [0x1079a50]
jae 0x1021149
mov esi, dword [0x1079a48]
mov dword [0x1079a20], esi
mov dword [0x1079a24], ecx
mov ecx, dword [0x1079a50]
mov dword [0x1079a28], ecx
mov dword [0x1079a2c], edx
mov byte [eax + 0x5d1], 1
jmp 0x1021150
mov byte [eax + 0x5d1], 0
mov eax, dword [0x10566d8]
cmp dword [eax + 0x684], edi
je 0x102117e
lea eax, [ebp - 0x14c]
push eax
push edi
push edi
push 0x103bcff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x144], eax
mov eax, dword [0x10566d8]
cmp dword [eax + 4], edi
ja 0x1021188
cmp dword [eax + 8], edi
jbe 0x1021199
push eax
call fcn.0101fa39
mov dword [ebp - 0x134], eax
mov eax, dword [0x10566d8]
cmp dword [ebp - 0x144], edi
je 0x10211b4
push 0xffffffffffffffff
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10566d8]
cmp dword [eax + 4], edi
ja 0x10211dc
cmp dword [eax + 8], edi
ja 0x10211dc
lea ecx, [eax + 0x684]
cmp dword [ecx], edi
je 0x10211f0
mov ecx, dword [ecx]
cmp dword [ecx + 0x14], edi
jne 0x10211f0
call fcn.0103b367
mov dword [ebp - 0x134], edi
jmp 0x10211eb
call fcn.0102bbd7
call fcn.01025bbc
call fcn.0101f121
mov eax, dword [0x10566d8]
cmp dword [ebp - 0x134], edi
jne 0x10202d3
add eax, 0x684
cmp dword [eax], edi
je 0x10202c7
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
cmp eax, edi
je 0x10202c7
jmp 0x10210e3
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x134]
call fcn.0104f270
ret 4