Function at 0x1003630a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
mov byte [esp + 0x10], cl
mov esi, edx
mov dword [esp + 0x1c], 0x3285
cmp dword [esp + 0x1c], 0x34f1
push edi
mov dword [esp + 0x1c], esi
jle 0x100363b1
push 0
push 0
push 0xe2d
push 0x114d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor edi, edi
xor ebx, ebx
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x28]
and eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036371
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10009a96
inc esi
cmp esi, 0x4f39
jl 0x10036353
inc ebx
cmp ebx, 0x1891
jl 0x10036351
inc edi
cmp edi, 0x24aa
jl 0x1003634f
push 0x1208
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [esp + 0x1c]
cmp byte [ebp + 0x1c], 0
je 0x100364fe
mov dword [esp + 0x1c], 0x26a2
cmp dword [esp + 0x1c], 0x288f
jle 0x10036430
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x24], esi
xor ebx, ebx
sar esi, cl
mov eax, esi
lea ecx, [esp + 0x40]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100363f9
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.10009a96
inc ebx
cmp ebx, 0x1fd6
jl 0x100363df
mov esi, dword [esp + 0x18]
inc edi
cmp edi, 0x2690
jl 0x100363d5
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x7410
jl 0x100363d3
cmp dword [esp + 0x1c], 0x22c5
jge 0x10036445
push str.caoe_swcggndkl_ygb_jjowoiq_eawlfi
call fcn.1003f93c
pop ecx
cmp byte [ebp + 0x10], 0
je 0x100364ea
mov dword [esp + 0x18], 0x4cf1
cmp dword [esp + 0x18], 0x4f82
jle 0x100364c3
xor esi, esi
mov dword [esp + 0x1c], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [esp + 0x58]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003648c
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [esp + 0x60]
call fcn.10009a96
inc ebx
cmp ebx, 0x137
jl 0x10036472
mov esi, dword [esp + 0x1c]
inc edi
cmp edi, 0x4f4f
jl 0x10036469
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x7d7f
jl 0x10036467
cmp dword [esp + 0x18], 0x4c44
jge 0x100364d8
push str.kqttglnte_iytn_ojbdlktj_jzuz_hedboubt_ymywty_tyfzqphs
call fcn.1003f93c
pop ecx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10036556
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x10036556
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10036556
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x10036556
cmp byte [esp + 0x14], 0
je 0x10036533
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
cmp dword [eax], 0
jl 0x10036556
mov ecx, dword [ebp + 0x14]
mov dword [esi], 0
jmp 0x10036525
cmp dword [ecx], 0
jne 0x1003652a
inc dword [esi]
cmp dword [esi], 1
jle 0x1003651e
dec dword [eax]
cmp dword [eax], 0
jge 0x10036516
jmp 0x10036556
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ecx]
cmp eax, 0xe52d
mov eax, dword [ecx]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x20]
setle cl
imul ecx, ecx, 0xe83
mov dword [eax], ecx
cmp dword [esp + 0x20], 0x303c
jge 0x1003656b
push str.bxrpnj_fcpkfpd_cagirvunm_bxqe_kafffig_ggippbt_scefs
call fcn.1003f93c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret