Function at 0x100044f0
Capabilities:
Get memory capacity
Get system firmware table
Hash data with crc32
Log keystrokes via polling
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [ebp - 0x44], ecx
cmp dword [0x10066b44], 0x66587b59
jne 0x1000470d
push 0
push 0
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
call dword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
push 0
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0
push 0x100c5104
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FrameRect]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUpdatedClipboardFormats]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassWord]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUpdatedClipboardFormats]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
push 0
push 0
call dword [sym.imp.USER32.dll_FreeDDElParam]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetRawInputBuffer]
push 0
push 0
push 0x100c513c
push 0
push 0
push 0
push 0
push 0x100c5178
call dword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
push 0
call dword [sym.imp.USER32.dll_IsCharUpperW]
mov dword [ebp - 0x20], 0
jmp 0x1000471f
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x100
jge 0x1000476f
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10004740
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 8
jge 0x10004760
mov eax, dword [ebp - 0x24]
shr eax, 1
mov ecx, dword [ebp - 0x24]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x10004737
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp + edx*4 - 0x448], eax
jmp 0x10004716
mov dword [ebp - 0x10], 0x23fe
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0x7e2
mov dword [ebp - 0x14], 0x7d7
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x18]
add edx, 0xe7a
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0x21e4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x2416
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0x80000001
jns 0x100047d0
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100047df
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x100047c0
mov eax, dword [ebp - 0xc]
sub eax, 0x1c9d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
add edx, 0xc4d
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x23b3
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0x254a
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000001
jns 0x10004845
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1000485c
cmp dword [ebp - 8], 0
jle 0x1000485c
mov eax, dword [ebp - 8]
sub eax, 0x1bd3
mov dword [ebp - 8], eax
jmp 0x10004868
mov ecx, dword [ebp - 8]
add ecx, 0x1bd3
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0xeed
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1b9e
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 0x7d8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1988
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0x1595
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x112d
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x183c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0xd05
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
sub eax, 0x1517
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x150c
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004949
cmp dword [ebp - 0xc], 0
jle 0x10004949
mov edx, dword [ebp - 0xc]
sub edx, 0x163c
mov dword [ebp - 0xc], edx
jmp 0x10004954
mov eax, dword [ebp - 0xc]
add eax, 0x163c
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1a43
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
and edx, 0x80000001
jns 0x10004970
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1000497f
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10004960
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x104b
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x22b
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2355
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x21bf
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x8d4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x8f4
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
add edx, 0x1751
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1680
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1682
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x34], 0
je 0x10004c9e
mov ecx, dword [0x10066b44]
xor edx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x40], 0x86ae9e71
jne 0x10004c71
cmp dword [ebp - 0x3c], 0
jne 0x10004c71
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetUserObjectSecurity]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UserHandleGrantAccess]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov edx, dword [ebp - 0x28]
shr edx, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 0x28]
and ecx, 0xff
xor edx, dword [ebp + ecx*4 - 0x448]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x10004a2f
mov eax, dword [ebp - 0x28]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8