Function at 0x100032e0
Capabilities:
Create pipe
Create thread
Get keyboard layout
Hash data with crc32
Identify system language via api
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push esi
push edi
mov dword [ebp - 0x60], ecx
mov eax, dword [0x1011d35c]
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x4c], 0xf9e2f2c6
jne 0x100034d7
cmp dword [ebp - 0x48], 0
jne 0x100034d7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push 0
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateIconFromResource]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0
push 0
push 0
push 0
push str.dA4yUZ5V5ee136nb
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterBadMemoryNotification]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuDefaultItem]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
call dword [sym.imp.USER32.dll_GetShellWindow]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
push 0
push 0
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x54]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
call dword [sym.imp.USER32.dll_GetMenu]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
mov dword [ebp - 0x28], 0
jmp 0x100034e9
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x100
jge 0x10003539
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0
jmp 0x1000350a
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 8
jge 0x1000352a
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp - 0x2c]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 0x2c], eax
jmp 0x10003501
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + edx*4 - 0x468], eax
jmp 0x100034e0
mov dword [ebp - 0x20], 0xffe
mov dword [ebp - 0x14], 0x19f1
mov dword [ebp - 0x10], 0x1feb
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x10]
sub edx, 0x2429
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x125c
mov ecx, dword [ebp - 0xc]
sub ecx, 0x248
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0xbdc
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0x11e0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
and ecx, 0x80000003
jns 0x100035c7
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100035dd
cmp dword [ebp - 8], 0
jle 0x100035dd
mov edx, dword [ebp - 8]
add edx, 0x23d1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
add eax, 0x16d4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x253f
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x19e7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1eef
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 0x136b
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x211a
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0xd06
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, 0x73a
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x1cdd
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc7b
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
add edx, 0x166a
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0
jmp 0x100036ec
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0x1f
jge 0x100036fd
mov edx, dword [ebp - 0x24]
sub edx, 2
mov dword [ebp - 0x24], edx
jmp 0x100036e3
mov eax, dword [ebp - 0xc]
sub eax, 0x1e27
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1941
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, 0x18ef
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xd74
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x246e
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x86e
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x1000376d
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1000377d
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c13
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 0x21f1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, 0x6b1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x23e4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100037d5
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x100037bb
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1853
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
sub eax, 0xa
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x13f
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 0xf66
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x212a
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x6b1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x15b2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1bca
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0xfe0
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xee1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x3c], 0
jmp 0x100038f3
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x35
jge 0x10003904
mov ecx, dword [ebp - 0x10]
add ecx, 7
mov dword [ebp - 0x10], ecx
jmp 0x100038ea
mov edx, dword [ebp - 0x18]
add edx, 0xe3
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x2708
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
sub eax, 0x586
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x22dd
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x26d1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xdfc
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x95
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1bcf
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1270
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1f8a
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x37d
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x100039f7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10003a09
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1625
mov dword [ebp - 0x14], ecx
jmp 0x10003a15
mov edx, dword [ebp - 0x14]
add edx, 0x1625
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003a38
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10003a1e
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x16fa
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
add edx, 0x161
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, 0xb1b
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x35e
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x982
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x251f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x80000001
jns 0x10003acd
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10003adc
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10003abd
mov eax, dword [ebp - 0x18]
sub eax, 0x1662
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 0
jmp 0x10003af9
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x35
jge 0x10003b0a
mov edx, dword [ebp - 8]
sub edx, 2
mov dword [ebp - 8], edx
jmp 0x10003af0
mov eax, dword [ebp - 8]
sub eax, 0xd98
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x13d5
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x14be
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
add edx, 0xae2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x520
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0xc9b
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x2615
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x11be
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1c82
mov dword [ebp - 8], ecx
mov dword [ebp - 0x30], 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x44], 0
je 0x10003d9f
mov ecx, dword [0x1011d35c]
xor edx, edx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x5c], 0xf70b9a33
jne 0x10003d72
cmp dword [ebp - 0x58], 0
jne 0x10003d72
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetRawInputDeviceInfoW]
push 0
call dword [sym.imp.USER32.dll_WindowFromDC]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TabbedTextOutW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUpdateRect]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CascadeWindows]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
call dword [sym.imp.USER32.dll_DdeFreeDataHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateIcon]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
push str.Q3tW83Vlz13FAM8917D1LnEihZ5
push 0
call dword [sym.imp.USER32.dll_CharNextExA]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
push 0
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov eax, dword [ebp - 0x30]
shr eax, 8
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
xor edx, dword [ebp - 0x30]
and edx, 0xff
xor eax, dword [ebp + edx*4 - 0x468]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x10003bc3
mov eax, dword [ebp - 0x30]
xor eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8