Function at 0x10003720
Capabilities:
Connect pipe
Delete directory
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x1003fb04], 0x4d662ae5
jne 0x10003962
push 0
push 0
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
call dword [sym.imp.USER32.dll_OpenIcon]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
call dword [sym.imp.USER32.dll_CloseWindowStation]
push 0
push 0x10069c40
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x10069c70
call dword [sym.imp.KERNEL32.dll_IsValidLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FillRect]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
call dword [sym.imp.USER32.dll_DdeUnaccessData]
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterSuspendResumeNotification]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuContextHelpId]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
call dword [sym.imp.USER32.dll_DdeUninitialize]
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push 0
call dword [sym.imp.USER32.dll_IsHungAppWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeClientTransaction]
push 0
push 0
push 0x10069c98
push 0
push 0
push 0x10069cd4
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
push 0
call dword [sym.imp.USER32.dll_GetClipCursor]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.USER32.dll_TrackMouseEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetUserObjectSecurity]
mov eax, 4
imul ecx, eax, 0x2f
mov edx, dword [0x10060668]
mov dword [edx + ecx], 0xa47
call fcn.10003c40
mov eax, 4
imul ecx, eax, 0x34
mov edx, dword [0x10060668]
mov dword [edx + ecx], 0xa42
mov dword [ebp - 0x1c], 0x17d
mov dword [ebp - 0x10], 0x25b8
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x34], 0x68d
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xa3b
mov ecx, dword [ebp - 0xc]
sub ecx, 0x909
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 0
jmp 0x100039e9
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x39
jge 0x100039fa
mov eax, dword [ebp - 0x14]
sub eax, 6
mov dword [ebp - 0x14], eax
jmp 0x100039e0
mov dword [ebp - 0x24], 0xabe
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0x1ef1
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
add eax, 0x1e7e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x1f6b
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x35f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x64d
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1746
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x207d
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x2420
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x252f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x1c30
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x78b
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1543
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x98e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1bef
mov dword [ebp - 8], ecx
mov dword [ebp - 0x30], 0
jmp 0x10003b2b
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0x11
jge 0x10003b3c
mov eax, dword [ebp - 0x28]
sub eax, 2
mov dword [ebp - 0x28], eax
jmp 0x10003b22
mov ecx, dword [ebp - 8]
add ecx, 0xc00
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x6b6
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x160a
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, 0x477
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
add eax, 0xfb3
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x245f
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1a6c
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x136e
mov dword [ebp - 0x14], edx
mov eax, 4
imul ecx, eax, 0xc4
mov edx, dword [0x10060684]
mov dword [edx + ecx], str.AQAAAAUvCd1v_tlJAFswl1mMQxznX2h4iSMqEFSEbSCvcahnaGIa30GOuMtzGTAX1w4tEHNoD0tGNc_hSQN2WwBwROGfJo6GTmSODgRagZFeGilvkcUiFaQz3vr9ECUdaFyzw9GIeFzplySlrrnSdAVIe2CFkQBrNJCdCs_i45NADeMZRG3DNqXjtckY1NFiUW8rjjMnSY12xYGTZYP6Euv1lPeDEy7qPPEr65h2odukZgvJkz2otv4_tfeiFwpFZrqE5GdeAqs84Q3x1mOMQpqHEy3qrej9D3VOltgQaxTy6iwBGfVlqkGFmqlOhoxfI_HNQZQKnhgnwYRcOpBKXDSLUHc66stlEekCJdOWQMEM20dsR4WW2tZOvJTx_ovCWkcrK67CYk8gG9c6G9LU7pEig7ZvbDsGpsyNGW4ug5ijui7faxh9Ht9vyIk9BHeCftpUMojqTFiaPO6xKEQDPbvYrFCGUwKNjWd6I1mitu0XJTuudLqC40SKUjtifA2HlpSMVPOjpK8olHnsCG7DYcTf35cVT4yOybNifTsQe29o7NPaVbqxeVQG7HDbCl2qJ1_dZjFJmnKWtcNGFqP7v5K3ABHqb1r3AY6yOihlPKK06AQt8Vh4Z50iHubtgCx9hszBO7Q3nFsQK2RV1BrwNnw4J76DShDp4c5eWVX3RxPxkOz7qx0EOGdpL4j0pK0CYUZZFu8ANVZLEgfzI1heXMwQXUfAvvNJDK6hqYkCq5YFgABSoVpQ3kDaF6lWMrGxiwXcPbaWMxphwhqIkwyCF0DvyPUXBzYmlbaUPOYZlBV4F8TjCudXFV22ulkbUlCZ4tQ2nyfKwHIopPqsjjeKgLPNfYM22Gl0_phYMW9U0sKgp4NW0vQYlpYPm4j7UON9t3c3DakVirNCfLvfbqtY5Ujy3MxaVJBNOGjYIGAcNCNu6_x1yx4yuC7BxNAa7nHSQsGFxbvYJIwZyFl_yJ82wi2SPERYL4Qb1p8kZH8LeHIUkkuI9kPMCga_6wkG8ZBVBISFSSy237rLJ1x6bTuWvTvcJtd01tN9L46GejhbSDr2v975xu6APt8DxWedi0YqDRl_GgI6rHDcOrMjKS31eoIldWRBl0nCGXc05H6RLuLPL7mn4M7D9kYM8dZ6RIEeZKlc0x0tX3ENHPssw0rCFdjEK9cDtUoN1KKZkjYap67J2Jbr87pDJju5fXWtEEG3dMi31qGmhDecw93HFVb0JJHl3gUJJhjYvYcaU8aztZhccW29IMHr9HM7dtbLublFhIrGyfy_wBO9XM87WLkNdqHaGDsBCwGysRWfvZNzDoyB4V9zIi3ab5Pa4rD4AmMjomBDwsKFGWfGY7Cw7t2Ad2PyuqzosqGAOUsanjTMsNgLaLkMwRpWbgmRj1h4TVlwNE6o257sRL7olWmQmahcECvbpl5MN4i5yuic7Jz66HaikQpZ3bFSodngtTQygXuBWiY8ZzVdpCHxjWwgg9YVU5JWBqLoBQblz0HbZiqNzEiOazwoAWUGNSNzJKmJFPUl0mO3SX2gZl0NLCCVQNvfhOLoDpSphCmvDMNfTm2gKLVhyY9NH8zvgGiYu9h1YKWBkJTDBiGtVRv_m5U_NyV43mrgh6RMrzEbQoPi4f0AhGDHZiEpkM9bda8cqgTk0_kuzHOMFGdnJI5r2nJHlHxDnr_pBCqHgF5BtuLnAFr0ccAathPZeGEpOiXqAuE11J4VLr8joFVNKaNdE9G7JbzBfSj9X0qAv8cPxYvVzeSy93YLWCUnOpFFKNKhSdDepY8jUyspPetCSTNCwnuW1MlCxjLybTjrawmRz3nOBpmKnAM_dGJGUCd2Ig_3E8ARAv1QSOibTxZocXV7vE9nNelYJX97nDMLpXJ4Vzk4jHR1ntJWWsk3hUO4_2KXGnh0nZsF7ikqEElYYjU9GHAFe3pK3JJDPcZVnfHre1AqEBmGirIavFPiYO9Hm6pd_i8neU0xNfn5ugC0DkodtqvFvNHMHb_sXmTmfhcS8mVWH_NE0zKmNcCFIkxx0ZcUEZu1JPs1HZboLHh2K14TXrJkz0e8cG7psBgbGA_79oeQu9DsXn49xWAxsdiVNERBKhA5Ea7WFgaFmAmYsomSlkSzPVsY5vbTDeHRg6pQ_r1MKFZWQgvxjR1XyTga5Rm6ZPq92akzwCaYx9wpgaFNTkaUN2SJqZT5rMFV6Ey2aTjWsxi783gL8tgpaVeSjA7M3M4w1aC3cYhm1IO7_FcMO0Om8ugZZZ2K09BeV1gPZ5tHBG98qrNshpM91wjv40aFaaXSFCGcZH5WujliK7zImz5OFivHDwS217KSlTwstK2vHwqFdkZZhhUFJ6s1UZV6gCXo95X1VsOSjtSsh_nnzupxAuYgpoEPsp0XyiQQHzU0X1rGvb_IeYCO0Qhmgcl_izplzLfiQA86iOyV3Km9cdspraMsFb6ZOvPW5b4j5yFm1F8JzAE6Oq59EhNdXrQ0ixcjCqJSfPlKsfwQ72Tm0qpUrMCoq97KBlP0j5gVRggjP4d6u7N2wCutisteXEpfEBDlBytJqJVEX6i2ls4m_qcQg0N1xfJGvaOCQTIbgNdpi6qpoSYkHIz_X1YIPYN1Gib_j7Ky9fvSowMNYv5Rc1ENWrbIQa8R53YTlHHGSGoZSwvf8Guocwtr7FDTYWPybCqrcTlvnq1CGeGxiVVFzxNeoSTNUE0kKihbJ4iZU2ehGYzvfHSEtRe_ufc2MBrYDrsfFtfzi6C5SembNJIBcV29gNrVT2fH9zCg_1Ew7TyaFDKIOmOO8_Rn3VjN6I6UMU7x83VAHG62lKUbk0MsDZluKH6ei0mUuJMWP3fXWWNjURfPtk92La2SwqPiICxdCd26GoTdSFXhWoJYu0IM5Z62THD6_F3SEBB0nkL7rVYXn8WNpq21Z_lX4odjUbDzY9slKQ4bdOmwyxl_rzVx9SqCCxpu_H16Z6awJ5pPa4ulgWXSt2HgM2bUCm0xW1H1HIbal62CehGgKK2xWFPEf4eBI1VIkEXlL6w_Kb3BZNr1WDnPTdJfbIDEwdwx0YcVWnWtLhaO3edM3QDJrRrFGtRUue26C9HtQO59viZfONtKYwSmjXZmCo8G1FTXJOn5l2VLBBxVWPRGLzM2g8Ozq8YrkA4aLNMc5xfrzeaGnOeVUb9KR6SaCdGE0SKowPybzacaqCelGSh2JjYXS1R41WWhYqrIFxFcW6h363d5KIPp0M7i0RKj2yD5SBvnARTBRT4iH4PL4UJzSF0WjORSqJEp8a9LDNSkjYQD1mZO7Cbc80O4LFNN2nKPRRfId2K20LkJxmYP0oPwpjshw69mprzTPQZ1Tgdifbd6ZFXuOaokQRVN56BsGSGflnC6cIraIDqo4pTVaWL1bKYEbgKRxSRea3CMe4jEuiQIvetE1hJKOoVth2hfoMFDDfJIYH5Ww
mov esp, ebp
pop ebp
ret