Function at 0x10822f8
Capabilities:
Create thread
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10e607c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], 0xff
call fcn.01022d6e
movsx esi, word [eax + 0xad4]
xor eax, eax
imul esi, esi, 0x258
mov edi, 0x10ef2c4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call fcn.0107aa9e
push eax
call fcn.0107a9b7
test ax, ax
je 0x10823b0
cmp word [ebp + 0xc], bx
je 0x10823b0
call fcn.01050efc
call fcn.0107b5e8
lea eax, [ebp - 0x224]
push eax
call fcn.0107d322
lea eax, [ebp - 0x224]
push eax
call fcn.0107ceed
push eax
call fcn.01081639
cmp eax, ebx
je 0x108239f
add eax, 0x14
push eax
call fcn.0107aa74
mov dword [ebp - 0x230], 1
lea eax, [ebp - 0x214]
push eax
call fcn.0107aa9e
call fcn.0107b681
lea eax, [ebp - 0x214]
push eax
call fcn.0107a9b7
test ax, ax
jne 0x10823f3
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
push 0x1009b90
lea eax, [ebp - 0x204]
push eax
call fcn.0108067f
or edi, 0xffffffff
cmp eax, edi
mov dword [0x10ef3f4], eax
jne 0x1082402
call fcn.01050f71
mov eax, 0x4c7
jmp 0x10825a8
call fcn.01050efc
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push 0x107d50e
push ebx
push ebx
mov dword [0x10ef3bc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x10ef3ec], eax
je 0x10824ca
mov dword [ebp - 0x22c], ebx
jmp 0x10824b0
inc dword [ebp - 0x22c]
cmp dword [ebp - 0x22c], 0x4b0
jl 0x108244f
call fcn.01050ed2
cmp dword [0x10ef3dc], ebx
jne 0x1082470
cmp dword [0x10ef3e0], ebx
jne 0x1082470
mov eax, esi
dec esi
test eax, eax
jg 0x1082470
mov dword [ebp - 0x228], 1
call fcn.01050a55
test eax, eax
je 0x108248c
cmp word [ebp - 0x228], bx
jne 0x108248c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10824ab
mov eax, dword [0x10ef3f4]
cmp eax, edi
mov dword [ebp - 0x228], 1
je 0x10824a5
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
mov dword [0x10ef3f4], edi
call fcn.0107875a
cmp dword [0x10ef3bc], edi
je 0x1082438
push dword [0x10ef3ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10ef3ec], ebx
mov eax, dword [0x10ef3f4]
cmp eax, edi
je 0x10824df
push eax
call sub.NTMSAPI.dll_CloseNtmsSession
mov dword [0x10ef3f4], edi
mov esi, dword [0x10ef3bc]
mov dword [ebp - 0x22c], esi
call fcn.01050f71
cmp esi, ebx
jne 0x1082512
cmp word [ebp - 0x228], bx
je 0x108253d
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10e6084]
call sub.NTMSAPI.dll_DismountNtmsMedia
cmp word [ebp - 0x228], bx
je 0x1082530
cmp word [ebp - 0x230], bx
je 0x1082530
lea eax, [ebp - 0x214]
push eax
call fcn.01081582
cmp esi, ebx
jne 0x108256b
cmp word [ebp - 0x228], bx
jne 0x108256b
cmp word [ebp + 8], bx
mov esi, 0x10ef2c4
mov edi, 0x10ef304
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10ef2e4
mov edi, 0x10ef370
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1082566
call fcn.01050de3
jmp 0x108256b
call fcn.01051d4b
cmp dword [0x10eae84], ebx
mov esi, 0x3e3
jne 0x1082593
push ebx
push 1
lea eax, [ebp - 0x214]
push eax
push dword [0x10e6084]
call sub.NTMSAPI.dll_DismountNtmsMedia
mov dword [ebp - 0x22c], esi
cmp word [ebp - 0x228], bx
je 0x10825a2
mov dword [ebp - 0x22c], esi
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret 8