Function at 0x1003b880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003de81
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x1004600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x9c], ecx
sub eax, 0
je 0x1003c0b3
sub eax, 1
jne 0x1003c091
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [0x1004ebcc], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
je 0x1003b8ec
push str.d3d12.dll
call esi
test eax, eax
jne 0x1003b930
cmp dword [0x1004ebc8], 0
je 0x1003b900
push str.d3d11.dll
call esi
test eax, eax
jne 0x1003b930
cmp dword [0x1004ebc4], 0
je 0x1003b914
push str.d3d10.dll
call esi
test eax, eax
jne 0x1003b930
cmp dword [0x1004ebc0], 0
je 0x1003c091
push str.d3d9.dll
call esi
test eax, eax
je 0x1003c091
push str.TClient.exe
call esi
push 0
mov dword [0x100d3dd8], eax
call esi
push 0xfffffffffffffff5
mov dword [0x100d3dd8], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x58]
call fcn.10038600
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
call fcn.1003b220
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0x17
movups xmmword [ecx], xmm0
push str.wmic_csproduct_get_uuid
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10037100
lea ecx, [ebp - 0x28]
call fcn.1003b440
add esp, 0x18
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
push 0x1003f332
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
call fcn.10037100
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbc]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
push str.UUID
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0
call fcn.10037100
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbc]
cmp dword [ebp - 0xa8], 0x10
lea edi, [ebp - 0x28]
mov edx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0xac]
cmovae ecx, edx
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], edi
cmp esi, eax
ja 0x1003bb34
sub eax, esi
test esi, esi
jne 0x1003ba49
xor edi, edi
jmp 0x1003bb09
movsx ecx, byte [ecx]
inc eax
add eax, edi
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], eax
sub eax, edi
push eax
push ecx
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1003bb2e
mov edx, dword [ebp - 0x7c]
mov ecx, edi
sub esi, 4
jb 0x1003ba91
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003ba96
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1003ba80
cmp esi, 0xfffffffc
je 0x1003baca
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1003bac3
cmp esi, 0xfffffffd
je 0x1003baca
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1003bac3
cmp esi, 0xfffffffe
je 0x1003baca
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1003bac3
cmp esi, 0xffffffff
je 0x1003baca
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1003baca
sbb eax, eax
or eax, 1
jmp 0x1003bacc
xor eax, eax
test eax, eax
je 0x1003bafb
mov eax, dword [ebp - 0xa0]
inc edi
sub eax, edi
push eax
push dword [ebp - 0xa4]
push edi
call sub.VCRUNTIME140.dll_memchr
mov esi, dword [ebp - 0xac]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1003ba72
jmp 0x1003bb2e
sub edi, dword [ebp - 0x78]
cmp edi, 0xffffffff
je 0x1003bb2e
mov esi, dword [ebp - 0xac]
cmp dword [ebp - 0x84], 0x10
lea eax, [ebp - 0x98]
push dword [ebp - 0x88]
cmovae eax, dword [ebp - 0x98]
lea ecx, [ebp - 0x28]
push eax
push esi
push edi
call fcn.1003c290
mov edx, dword [ebp - 0xbc]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xa8]
cmp eax, 0x10
jb 0x1003bb6e
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bb64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c081
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x84]
cmp ecx, 0x10
jb 0x1003bbac
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bba2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c081
push ecx
push edx
call fcn.1003c79d
add esp, 8
push 0xb0
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.UzVSUk5GMFI1MjI4MDBWezVhNTU4ZjdjLWJiNWEtMTFlZC04OTFmLTgwNmU2ZjZlNjk2M30gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQoyODQ5RDY3OC04NzVBLTIzNEMtODQ4MC05ODA2QTlBQTdDOUMgIA0KDQo
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.10037100
mov byte [ebp - 4], 5
mov eax, 0x7fffffff
mov edx, dword [ebp - 0x48]
sub eax, edx
mov ecx, dword [ebp - 0x60]
cmp eax, ecx
jb 0x1003c0bc
mov eax, dword [ebp - 0x44]
lea esi, [ebp - 0x58]
cmp eax, 0x10
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x58]
lea edi, [ebp - 0x98]
cmovae esi, eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x5c]
xorps xmm0, xmm0
cmp eax, 0x10
mov dword [ebp - 0x78], esi
mov dword [ebp - 0xa0], eax
lea esi, [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmovae esi, eax
mov dword [ebp - 0xc0], eax
lea eax, [ecx + edx]
mov dword [ebp - 0xa4], esi
mov esi, 0xf
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x7c], eax
movups xmmword [ebp - 0x98], xmm0
cmp eax, esi
jbe 0x1003bcd8
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1003bc6f
mov esi, 0x7fffffff
jmp 0x1003bc79
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x1003bcb9
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x1003c0c1
push eax
call fcn.1003cc6e
add esp, 4
test eax, eax
je 0x1003bf1b
mov edx, dword [ebp - 0x48]
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x1003bccf
test ecx, ecx
je 0x1003bccd
push ecx
call fcn.1003cc6e
mov edx, dword [ebp - 0x48]
add esp, 4
mov edi, eax
jmp 0x1003bccf
xor edi, edi
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x98], edi
push edx
push dword [ebp - 0x78]
mov dword [ebp - 0x88], eax
push edi
mov dword [ebp - 0x84], esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0xa4]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x7c]
add esp, 0x18
mov byte [edi + eax], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edx, dword [ebp - 0x88]
cmovae ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov edi, dword [ebp - 0x18]
sub eax, edx
mov dword [ebp - 0x78], edx
push edi
push ecx
cmp edi, eax
ja 0x1003bd70
cmp dword [ebp - 0x84], 0x10
lea esi, [ebp - 0x98]
lea eax, [edx + edi]
cmovae esi, dword [ebp - 0x98]
mov dword [ebp - 0x88], eax
lea eax, [esi + edx]
push eax
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 0x78]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0x98]
jmp 0x1003bd7f
push dword [ebp - 0x80]
lea ecx, [ebp - 0x98]
push edi
call fcn.1003c5a0
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
movups xmmword [ebp - 0xf4], xmm1
movq qword [ebp - 0xe4], xmm0
mov dword [eax + 0x10], 0
lea edx, [ebp - 0xf4]
mov dword [eax + 0x14], 0xf
lea ecx, [ebp - 0xdc]
mov byte [eax], 0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xe0], 0x10
mov dword [ebp - 0x78], eax
movd eax, xmm1
cmovae edx, eax
lea eax, [ebp - 0x78]
push eax
call fcn.1003b700
mov edi, dword [ebp - 0xdc]
lea ecx, [ebp - 0x40]
mov esi, dword [ebp - 0xcc]
lea edx, [ebp - 0xdc]
add esp, 4
cmp dword [ebp - 0x2c], 0x10
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0xc8], 0x10
cmovae edx, edi
cmp esi, dword [ebp - 0x30]
jne 0x1003be64
sub esi, 4
jb 0x1003be21
nop dword [eax + eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1003be26
add edx, 4
add ecx, 4
sub esi, 4
jae 0x1003be10
cmp esi, 0xfffffffc
je 0x1003be5a
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x1003be53
cmp esi, 0xfffffffd
je 0x1003be5a
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x1003be53
cmp esi, 0xfffffffe
je 0x1003be5a
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x1003be53
cmp esi, 0xffffffff
je 0x1003be5a
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x1003be5a
sbb eax, eax
or eax, 1
jmp 0x1003be5c
xor eax, eax
mov byte [ebp - 0x71], 1
test eax, eax
je 0x1003be68
mov byte [ebp - 0x71], 0
mov eax, dword [ebp - 0xc8]
cmp eax, 0x10
jb 0x1003be9e
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1003be94
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003bf1b
push ecx
push edi
call fcn.1003c79d
add esp, 8
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0xf
mov byte [ebp - 0xdc], 0
cmp ecx, 0x10
jb 0x1003beef
mov edx, dword [ebp - 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bee5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003bf1b
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov ecx, dword [ebp - 0x84]
cmp ecx, 0x10
jb 0x1003bf2b
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bf21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003bf21
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003c79d
add esp, 8
cmp byte [ebp - 0x71], 0
push 0
je 0x1003bf98
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x1003aaf0
push 0
push 0
call edi
push 0
push 0
push dword [ebp - 0x9c]
push 0x1003ad90
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0
push 0
push dword [ebp - 0x9c]
push 0x1003b0c0
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push dword [ebp - 0x9c]
push 0x1003b170
push 0
push 0
call edi
push eax
call esi
jmp 0x1003bfaa
push str.Youre_not_allowed.
push str.Hey_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x1003bfe0
mov edx, dword [ebp - 0x40]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003bfd6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c081
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1003c010
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003c006
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c081
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x1003c058
mov edx, dword [ebp - 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003c04e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c081
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov ecx, dword [ebp - 0xc4]
cmp ecx, 0x10
jb 0x1003c091
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003c087
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003c087
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003c79d
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret 0xc
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call fcn.10036eb0
call fcn.10036e10
int3