Function at 0x100034b0
Capabilities:
Create directory
Get disk size
Get file attributes
Get system information on windows
Hash data with crc32
Manipulate console buffer
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov dword [ebp - 0x60], ecx
mov eax, dword [0x1007cb04]
xor ecx, ecx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x5c], 0xbd1854db
jne 0x10003739
cmp dword [ebp - 0x58], 0
jne 0x10003739
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push str.zdV5kJfqplFKsAd8IrUXXW9gA
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 0
call dword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_IntersectRect]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
call dword [sym.imp.USER32.dll_GetProcessDefaultLayout]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefRawInputProc]
push 0
push 0
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
push 0
call dword [sym.imp.KERNEL32.dll_FlsFree]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdePostAdvise]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeSetUserHandle]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetClassInfoExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUserObjectSecurity]
push 0
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TabbedTextOutW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
push 0
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push 0
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DlgDirSelectExW]
push 0
call dword [sym.imp.USER32.dll_SetDoubleClickTime]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x18], 0
jmp 0x1000374b
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x100
jge 0x1000379b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], 0
jmp 0x1000376c
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 8
jge 0x1000378c
mov ecx, dword [ebp - 0x24]
shr ecx, 1
mov edx, dword [ebp - 0x24]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x24], ecx
jmp 0x10003763
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x464], ecx
jmp 0x10003742
mov dword [ebp - 0x48], 0x20eb
mov dword [ebp - 0x14], 0x446
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], 0
mov dword [ebp - 8], 0x207a
mov dword [ebp - 0x28], 0x4c2
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x50], 0xba
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40], 0x1543
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], 0
jmp 0x10003810
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x5b
jge 0x10003821
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x10003807
mov dword [ebp - 0xc], 0xa79
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x2c], 0x18e7
mov dword [ebp - 0x10], 0x72d
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x3c], 0
jmp 0x1000386c
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x54
jge 0x1000387d
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
jmp 0x10003863
mov edx, dword [ebp - 0xc]
sub edx, 0x864
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x84a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x14]
add edx, 0x18f1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x4a6
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
and edx, 0x80000003
jns 0x100038d5
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x100038e4
mov eax, dword [ebp - 0x1c]
sub eax, 0x13f9
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
add ecx, 0x2600
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x1be5
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x5af
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xe9c
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x54], 0
je 0x10003bb6
cmp dword [0x1007cb04], 0x2e20ded5
jne 0x10003b8a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemID]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 0
call dword [sym.imp.USER32.dll_GetMenuContextHelpId]
push 0
push 0
call dword [sym.imp.USER32.dll_CharPrevW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollBarInfo]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SubtractRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ReuseDDElParam]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeferWindowPos]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
call dword [sym.imp.USER32.dll_CountClipboardFormats]
push 0
call dword [sym.imp.USER32.dll_DeregisterShellHookWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
push 0
call dword [sym.imp.USER32.dll_SwapMouseButton]
push 0
push 0
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
push 0
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
push 0
push 0
push 0
push 0
push str.TNGqOUMDKb7UJ1uE9p9NSJ
push 0
push str.hz84AF4eoghA94UU4F75XZ8fsYKz2
push 0
push str.y6X2BqU3dcEBDpog1L9P49deO49g
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetClassInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0
push str.i7DRR22Kk5dl52bstIhqSe
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
push 0
push 0
call dword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
push 0
push str.9jO9MBTiKlJjEJm
call dword [sym.imp.USER32.dll_OemToCharW]
push 0
call dword [sym.imp.USER32.dll_UnregisterPowerSettingNotification]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
push 0
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
mov ecx, dword [ebp - 0x30]
shr ecx, 8
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 0x30]
and eax, 0xff
xor ecx, dword [ebp + eax*4 - 0x464]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x10003936
mov eax, dword [ebp - 0x30]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8