Function at 0x100032e0
Capabilities:
Check for unexpected memory writes
Create process on windows
Delete directory
Get common file path
Get disk information
Hash data with crc32
Log keystrokes via polling
Register raw input devices
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [ebp - 0x5c], ecx
mov eax, dword [0x100fb724]
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x50], 0xcf29b5ae
jne 0x100034e2
cmp dword [ebp - 0x4c], 0
jne 0x100034e2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollRange]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x40], eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push 0
push 0
call dword [sym.imp.USER32.dll_SetPhysicalCursorPos]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumPropsExW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
push 0
mov ecx, dword [ebp - 0x44]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
call dword [sym.imp.USER32.dll_GetFocus]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexExW]
push 0
call dword [sym.imp.USER32.dll_CloseDesktop]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
mov dword [ebp - 0x14], 0
jmp 0x100034f4
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jge 0x10003543
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0
jmp 0x10003515
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 8
jge 0x10003534
mov edx, dword [ebp - 0x18]
shr edx, 1
mov eax, dword [ebp - 0x18]
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
mov dword [ebp - 0x18], edx
jmp 0x1000350c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x468], edx
jmp 0x100034eb
mov dword [ebp - 4], 0x1419
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x2a8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x113
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x24], 0
jmp 0x10003586
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x25
jge 0x10003597
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
jmp 0x1000357d
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1bc9
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], 0
jmp 0x100035cf
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x14
jge 0x100035e0
mov eax, dword [ebp - 8]
add eax, 6
mov dword [ebp - 8], eax
jmp 0x100035c6
mov ecx, dword [ebp - 0xc]
add ecx, 0x841
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x4fa
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0
jmp 0x10003613
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x13
jge 0x10003624
mov edx, dword [ebp - 8]
add edx, 5
mov dword [ebp - 8], edx
jmp 0x1000360a
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1074
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 0x80000003
jns 0x10003649
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000365e
cmp dword [ebp - 0xc], 0
jle 0x1000365e
mov eax, dword [ebp - 0xc]
sub eax, 0x18f9
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf89
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1ddb
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0xe13
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000003
jns 0x100036c7
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100036d7
mov edx, dword [ebp - 4]
sub edx, 0x7e3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1386
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xc5d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], 0
jmp 0x1000371b
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0xd
jge 0x1000372c
mov eax, dword [ebp - 0xc]
sub eax, 3
mov dword [ebp - 0xc], eax
jmp 0x10003712
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x14ad
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1f18
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0xc46
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x228f
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0x58e
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x80000001
jns 0x100037b5
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100037c4
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x100037a5
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1bcf
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x25b7
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0xf4b
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x438
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1acb
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1fe2
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x1423
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x1b9e
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x258f
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xa84
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x1e07
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x1e9a
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xfb2
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 0xd75
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1e35
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x111e
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1ffb
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x276
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x3cc
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 0xe30
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x1582
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
jmp 0x10003909
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0x17
jge 0x1000391a
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
jmp 0x10003900
mov eax, dword [ebp - 4]
sub eax, 0x13e7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2650
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0x2392
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
and ecx, 0x80000001
jns 0x10003955
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10003964
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x10003945
mov eax, dword [ebp - 0xc]
sub eax, 0x14cd
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x759
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x391
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xe4e
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x17f8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
and eax, 0x80000003
jns 0x100039ed
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x10003a03
cmp dword [ebp - 0x10], 0
jle 0x10003a03
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1fe
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c7
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x619
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x243e
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2413
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x21aa
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003a73
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10003a59
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x13dc
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x55b
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003ab7
cmp dword [ebp - 4], 0
jle 0x10003ab7
mov edx, dword [ebp - 4]
sub edx, 0xea6
mov dword [ebp - 4], edx
jmp 0x10003ac2
mov eax, dword [ebp - 4]
add eax, 0xea6
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1f0b
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x439
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x110d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x80000001
jns 0x10003afe
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10003b13
cmp dword [ebp - 4], 0
jle 0x10003b13
mov eax, dword [ebp - 4]
sub eax, 0x1530
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x124f
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0xa69
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1b18
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x80000001
jns 0x10003b4f
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10003b5e
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10003b3f
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1140
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0xba9
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x38], 0
jmp 0x10003b99
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0x40
jge 0x10003baa
mov eax, dword [ebp - 8]
sub eax, 4
mov dword [ebp - 8], eax
jmp 0x10003b90
mov ecx, dword [ebp - 4]
sub ecx, 0x1a9c
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10c9
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1a87
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x20e8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 0xa0
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x1f9b
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x20f5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x23f5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x58f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0xbe9
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x1e11
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0x1861
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x12dd
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xaf7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x80000001
jns 0x10003cd9
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10003ce8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10003cc9
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc7e
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1654
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x1087
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1a41
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x8e
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xc87
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1552
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x9d6
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x1a0f
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x60
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x6b9
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0x48], 0
je 0x10004057
mov eax, dword [0x100fb724]
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x58], 0xafb8a5ca
jne 0x1000402a
cmp dword [ebp - 0x54], 0
jne 0x1000402a
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterPointerInputTarget]
push 0
call dword [sym.imp.USER32.dll_SetProcessRestrictionExemption]
push 0
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FrameRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push 0
call dword [sym.imp.USER32.dll_IsCharUpperW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
push 0
push 0x10105d18
call dword [sym.imp.USER32.dll_OemToCharW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefDlgProcW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetRegisteredRawInputDevices]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
push 0x10105d38
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CopyAcceleratorTableW]
push 0
push 0
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
push 0
push 0
call dword [sym.imp.USER32.dll_IsChild]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
push 0
push 0
call dword [sym.imp.USER32.dll_DdeQueryNextServer]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OfferVirtualMemory]
mov edx, dword [ebp - 0x1c]
shr edx, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 0x1c]
and ecx, 0xff
xor edx, dword [ebp + ecx*4 - 0x468]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x10003de1
mov eax, dword [ebp - 0x1c]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8