Function at 0x100106e0
Capabilities:
Check for debugger via api
Create directory
Create pipe
Create thread
Delete file
Get common file path
Get disk information
Get file size
Get hostname
Get uefi variable
Print debug messages
Read .ini file
Read file on windows
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092e06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x390
mov byte [0x101137ac], 1
cmp dword [ebp + 0xc], 1
jne 0x100112da
mov dword [0x101137a4], 0x87389150
movzx eax, byte [0x100b0b7d]
test eax, eax
je 0x100112d5
push 0x2a4
push 0x1000e210
lea ecx, [ebp - 0xc4]
push ecx
call fcn.10017270
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10017660
add esp, 8
cmp dword [0x101137a4], 0xec042e0
jne 0x10010940
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
call dword [sym.imp.GDI32.dll_GetSystemPaletteUse]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontUnicodeRanges]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyTextOutW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetSystemPaletteUse]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
push 0
push 0
push str.6t7ybNVoyK468iK
push 0
push str.4xg1Lb7c2Rk6olsO51THcxZ
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNLSString]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBPatternBrush]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetAspectRatioFilterEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetWindowExtEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMiterLimit]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerSetRequest]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRandomRgn]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDllDirectory]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0x26a
push 0x10009160
lea ecx, [ebp - 0xcc]
push ecx
call fcn.10017270
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10017660
add esp, 8
mov dword [ebp - 0x18], 0x1186
mov dword [ebp - 0x28], 0xa2c
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0xdc9
mov dword [ebp - 0x20], 0x24b1
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
add eax, 0x376
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xe34
mov dword [ebp - 0x10], 0x5c1
mov dword [ebp - 0x1c], 0x1a18
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x10]
sub edx, 0x244
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x44], 0
jmp 0x100109f2
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x35
jge 0x10010a03
mov ecx, dword [ebp - 0x18]
sub ecx, 7
mov dword [ebp - 0x18], ecx
jmp 0x100109e9
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x134d
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x10010a3f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10010a57
cmp dword [ebp - 0x14], 0
jle 0x10010a57
mov ecx, dword [ebp - 0x14]
add ecx, 0x1e5e
mov dword [ebp - 0x14], ecx
jmp 0x10010a63
mov edx, dword [ebp - 0x14]
sub edx, 0x1e5e
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, 0x200e
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1fe9
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x48], 0
jmp 0x10010ab7
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x5e
jge 0x10010ac8
mov ecx, dword [ebp - 0x34]
sub ecx, 7
mov dword [ebp - 0x34], ecx
jmp 0x10010aae
mov edx, dword [ebp - 0x14]
sub edx, 0x270d
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x38], 0x1f09
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x20]
and ecx, 0x80000001
jns 0x10010af4
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10010b06
mov edx, dword [ebp - 0x20]
add edx, 0x1fc6
mov dword [ebp - 0x20], edx
jmp 0x10010b11
mov eax, dword [ebp - 0x20]
sub eax, 0x1fc6
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x79a
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x24]
add eax, 0xf27
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x37f
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x130c
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x643
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000003
jns 0x10010b90
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x10010ba2
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1ea0
mov dword [ebp - 0x14], ecx
jmp 0x10010bae
mov edx, dword [ebp - 0x14]
add edx, 0x1ea0
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x1215
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010bd3
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x10010bb9
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x14]
and edx, 0x80000003
jns 0x10010bf5
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x10010c04
mov eax, dword [ebp - 0x14]
add eax, 0xea1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010c30
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10010c16
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4c], 0
jmp 0x10010c5d
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x57
jge 0x10010c6e
mov ecx, dword [ebp - 0x18]
add ecx, 7
mov dword [ebp - 0x18], ecx
jmp 0x10010c54
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1c91
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x1bd5
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x1b88
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x745
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x493
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x50], 0
jmp 0x10010cde
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 0x21
jge 0x10010cef
mov eax, dword [ebp - 0x28]
add eax, 3
mov dword [ebp - 0x28], eax
jmp 0x10010cd5
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1c81
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1a23
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x189b
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x1e90
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010d4a
mov edx, dword [ebp - 0x30]
sub edx, 0x20fb
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x13c4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf97
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x2222
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x7d4
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x1a04
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1856
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1f5a
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x556
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xed2
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x15ba
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x26c4
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x2386
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1ab1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x54], 0
jmp 0x10010e3e
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x23
jge 0x10010e4f
mov ecx, dword [ebp - 0x2c]
add ecx, 2
mov dword [ebp - 0x2c], ecx
jmp 0x10010e35
mov edx, dword [ebp - 0x14]
add edx, 0x993
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x2161
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x126a
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
and ecx, 0x80000001
jns 0x10010eb0
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10010ebf
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
jmp 0x10010ea0
mov eax, dword [ebp - 0x24]
sub eax, 0x1cc8
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x661
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x181e
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x6a3
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x15e5
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x58], 0
jmp 0x10010f27
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 0x63
jge 0x10010f38
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10010f1e
mov ecx, dword [ebp - 0x24]
sub ecx, 0x2667
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x59
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, 0x1741
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x1b7c
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010fac
mov edx, dword [ebp - 0x2c]
sub edx, 0x15a5
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
add eax, 0xa47
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x14ec
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
and edx, 0x80000001
jns 0x10010fd3
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10010fe2
mov eax, dword [ebp - 0x34]
sub eax, 0x6bb
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x245f
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
add eax, 0xdd5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x258c
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1945
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x38]
add eax, 0xa2d
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1e95
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x2091
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
add eax, 0x245f
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100110ce
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
jmp 0x100110b4
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x3f8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x27c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x34]
add eax, 0x24ca
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x5c], 0
jmp 0x10011139
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x56
jge 0x1001114a
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
jmp 0x10011130
mov edx, dword [ebp - 0x30]
add edx, 0xaa0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x60], 0
jmp 0x10011168
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x47
jge 0x10011179
mov ecx, dword [ebp - 0x10]
sub ecx, 7
mov dword [ebp - 0x10], ecx
jmp 0x1001115f
mov edx, dword [ebp - 0x38]
add edx, 0x1225
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x18]
add eax, 0x1293
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
add edx, 0xe60
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x8da
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xa92
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x64], 0
jmp 0x100111ce
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x64], 0x37
jge 0x100111df
mov eax, dword [ebp - 0x38]
sub eax, 2
mov dword [ebp - 0x38], eax
jmp 0x100111c5
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x582
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x2268
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x68], 0
jmp 0x1001123e
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x58
jge 0x1001124f
mov ecx, dword [ebp - 0x24]
add ecx, 2
mov dword [ebp - 0x24], ecx
jmp 0x10011235
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x40]
and edx, 0x80000001
jns 0x10011295
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100112a4
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
jmp 0x10011285
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
push 0x11a
push 0x1000d4c0
lea edx, [ebp - 0xd4]
push edx
call fcn.10017270
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10017660
add esp, 8
jmp 0x100116c3
cmp dword [ebp + 0xc], 2
jne 0x100116c3
lea eax, [ebp - 0x39c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x100116b8
lea ecx, [ebp - 0x39c]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.10013310
mov dword [ebp - 4], 0
push str._nMVFWlUTUTizKMDeZek.txt
lea ecx, [ebp - 0xbc]
call fcn.100132d0
push 1
push 0x40
push 1
lea edx, [ebp - 0xbc]
push edx
lea ecx, [ebp - 0x194]
call fcn.100119d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x194]
call fcn.10011950
movzx eax, al
test eax, eax
je 0x10011666
lea ecx, [ebp - 0xa4]
call fcn.100136f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x194]
push edx
call fcn.10017fa0
add esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x6c]
add edx, dword [ecx + 4]
mov ecx, edx
call fcn.10002af0
movzx eax, al
test eax, eax
je 0x1001164a
push 0
push str.vbwbBMnbMDXFkJhIaypZKlfhbdEGF
lea ecx, [ebp - 0xa4]
call fcn.10013380
cmp eax, 0xffffffff
je 0x10011645
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
jmp 0x1001136b
lea ecx, [ebp - 0x194]
call fcn.10011920
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.100134d0
jmp 0x10011695
push str.zZcLmHSRKtSJJIPXnXpCecGKeZJv
push 0x20a
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edx
lea eax, [ebp - 0xdc]
push eax
call fcn.10017270
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10017fd0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x194]
call fcn.100118f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.100132f0
jmp 0x100116c3
push str.OAYiHWmeVUYcpQQeWPAdP
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x101137a4]
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x80], 0xc6dad1f9
jne 0x100118cb
cmp dword [ebp - 0x7c], 0
jne 0x100118cb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.P3uyVYFupm8gP49uHI
call dword [sym.imp.KERNEL32.dll_AddDllDirectory]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
push 0
call dword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x78], edx
push 0
mov eax, dword [ebp - 0x78]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push str.p9chC5jkQd25y84zJeP1q3N4W
push 0
push str.TY48suL3m884L4XwN
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
movzx eax, byte [0x101137ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc