Function at 0x100032e0
Capabilities:
Check for unexpected memory writes
Copy file
Get geographical location
Get uefi variable
Hash data with crc32
Identify system language via api
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov dword [ebp - 0x58], ecx
cmp dword [0x101137a4], 0x2ebb5c8
jne 0x10003528
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
push 0
call dword [sym.imp.USER32.dll_MonitorFromRect]
push 0
push 0
call dword [sym.imp.USER32.dll_GetAncestor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
call dword [sym.imp.USER32.dll_CopyIcon]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push 0
push str.8tBgPYi3v4vAtO6i
push 0
push str.VAjKGbtNNA7Bzca
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawIcon]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuBarInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowModuleFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
call dword [sym.imp.KERNEL32.dll_GetErrorMode]
push 0
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowDisplayAffinity]
push 0
call dword [sym.imp.USER32.dll_DdeDisconnect]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
push 0
push 0
push 0
push 0
push 0
push 0
push str.16jmTU2MHWqtA99Q1vaFf8
push 0
push str.KAt6Bpzm33ZXFcECm
call dword [sym.imp.KERNEL32.dll_LCMapStringEx]
mov dword [ebp - 0x24], 0
jmp 0x1000353a
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x100
jge 0x1000358a
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], 0
jmp 0x1000355b
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 8
jge 0x1000357b
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp - 0x2c]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 0x2c], eax
jmp 0x10003552
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + edx*4 - 0x460], eax
jmp 0x10003531
mov dword [ebp - 0x14], 0x127e
mov dword [ebp - 0x20], 0x59b
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x1762
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
add eax, 0x1155
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa03
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x12f6
mov edx, dword [ebp - 4]
sub edx, 0x13e1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1cf9
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], 0x1768
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x1c]
and eax, 0x80000001
jns 0x10003623
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10003632
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x10003614
mov edx, dword [ebp - 4]
sub edx, 0x23dd
mov dword [ebp - 4], edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], 0x430
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000366d
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10003653
mov eax, dword [ebp - 0x3c]
add eax, 0x24d4
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x2649
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
add eax, 0x11eb
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x206
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x140a
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xc30
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x40], 0
jmp 0x100036e0
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x5d
jge 0x100036f1
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
jmp 0x100036d7
mov edx, dword [ebp - 8]
sub edx, 0xeda
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x16a9
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x16ce
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, 0x96a
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x172c
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x1f3c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1676
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x12a
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
sub eax, 0xaed
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1113
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 0x1175
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x2149
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x44], 0
je 0x10003ae7
mov edx, dword [0x101137a4]
xor eax, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x54], 0xe0a378e0
jne 0x10003aba
cmp dword [ebp - 0x50], 0
jne 0x10003aba
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OpenDesktopW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
push 0
call dword [sym.imp.USER32.dll_UpdateLayeredWindowIndirect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareType]
push 0
push 0
push str.1p2s42j333ZgnPe7H2NqxG832td1A
push 0
push str.R3XmW8UXTySX2Sw6
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
push str.mhq455unvdzs5T3hNJEuvp9F
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x48], ecx
push 0
mov edx, dword [ebp - 0x48]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x4c], eax
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumThreadWindows]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.USER32.dll_GetLastInputInfo]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_wvsprintfW]
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
push str.DdH8b1TBC5kqiP8mNMbzlNtO
push str.ssUyX72vEUnJ9Go6HlwwldO53aA
call dword [sym.imp.KERNEL32.dll_CopyFile2]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
mov edx, dword [ebp - 0x34]
shr edx, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 0x34]
and ecx, 0xff
xor edx, dword [ebp + ecx*4 - 0x460]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x100037dd
mov eax, dword [ebp - 0x34]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8