Function at 0x100034b0
Capabilities:
Create directory
Create pipe
Get common file path
Get geographical location
Hash data with crc32
Log keystrokes
Set uefi variable
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov dword [ebp - 0x60], ecx
mov eax, dword [0x10077b04]
xor ecx, ecx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x5c], 0xf59b2f96
jne 0x1000369d
cmp dword [ebp - 0x58], 0
jne 0x1000369d
push 0
push 0
push str.gTWAtkS4rneocLkQj
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
call dword [sym.imp.USER32.dll_AnyPopup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4c], eax
push 0
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x50], eax
push 0
mov ecx, dword [ebp - 0x50]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDCEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CopyImage]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
call dword [sym.imp.USER32.dll_SwapMouseButton]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassWord]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push str.ti2s2kv8VL4n9FNlbmat86R89G
push str.GmCPd2XCD15evsRQ45hx
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x2c], 0
jmp 0x100036af
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x100
jge 0x100036fe
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0
jmp 0x100036d0
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 8
jge 0x100036ef
mov edx, dword [ebp - 0x30]
shr edx, 1
mov eax, dword [ebp - 0x30]
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
mov dword [ebp - 0x30], edx
jmp 0x100036c7
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov dword [ebp + ecx*4 - 0x470], edx
jmp 0x100036a6
mov dword [ebp - 4], 0x5d0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x15af
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003736
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x1000371c
mov eax, dword [ebp - 4]
add eax, 0x305
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x251e
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xb21
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], 0x1422
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x8be
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0xd8a
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, 0x150
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0x1e47
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 4]
add edx, 0x1dc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x1b4c
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x3f5
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1d6b
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1be5
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 0xa8f
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003824
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x1000380a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
add ecx, 0x9c0
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], 0x23bd
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x20]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003887
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x1000386d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100038ad
mov edx, dword [ebp - 4]
sub edx, 0x14d3
mov dword [ebp - 4], edx
jmp 0x100038b8
mov eax, dword [ebp - 4]
add eax, 0x14d3
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x18de
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0xb9c
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x263e
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003911
cmp dword [ebp - 0xc], 0
jle 0x10003911
mov edx, dword [ebp - 0xc]
sub edx, 0xc3c
mov dword [ebp - 0xc], edx
jmp 0x1000391c
mov eax, dword [ebp - 0xc]
add eax, 0xc3c
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 0xfe8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
add eax, 0x6e1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x64b
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, 0xba2
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
add eax, 0xc16
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x100f
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
add edx, 0x2369
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x266b
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x242d
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1e5d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x22e2
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
add eax, 0x16a7
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
add ecx, 0x22d8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x710
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, 0xd9
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1673
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c67
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003ab5
cmp dword [ebp - 0xc], 0
jle 0x10003ab5
mov edx, dword [ebp - 0xc]
sub edx, 0x1e3f
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x180b
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
sub eax, 0xc73
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x8a
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
add eax, 0x254c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x1466
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x9ba
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xee5
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x20f9
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x17a3
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x10003b99
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10003ba9
mov ecx, dword [ebp - 0x14]
add ecx, 0x717
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x19af
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], 0
jmp 0x10003bd0
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0x28
jge 0x10003be1
mov edx, dword [ebp - 0x1c]
sub edx, 6
mov dword [ebp - 0x1c], edx
jmp 0x10003bc7
mov eax, dword [ebp - 4]
sub eax, 0x73c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0xa34
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0xf3e
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, 0xd82
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0x1080
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xb08
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
add edx, 0xaab
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1217
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 0x2bb
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x25c0
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
sub edx, 0x2d6
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1514
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1ba4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
and eax, 0x80000001
jns 0x10003cb4
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10003cc3
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x10003ca5
mov edx, dword [ebp - 0x20]
add edx, 0xa29
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1cab
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1d
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x40], 0
jmp 0x10003d19
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x3a
jge 0x10003d2a
mov ecx, dword [ebp - 8]
add ecx, 3
mov dword [ebp - 8], ecx
jmp 0x10003d10
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, 0x5cf
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x894
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x22aa
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0xa32
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x18d0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xebb
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
add eax, 0x23bb
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x157d
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xdeb
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x22c1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, 0x1ffe
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x80000001
jns 0x10003e25
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10003e3d
cmp dword [ebp - 8], 0
jle 0x10003e3d
mov edx, dword [ebp - 8]
add edx, 0xf64
mov dword [ebp - 8], edx
jmp 0x10003e48
mov eax, dword [ebp - 8]
sub eax, 0xf64
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x44], 0
jmp 0x10003e63
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x5d
jge 0x10003e74
mov eax, dword [ebp - 0x20]
add eax, 9
mov dword [ebp - 0x20], eax
jmp 0x10003e5a
mov dword [ebp - 0x34], 0xffffffff
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0x54], 0
je 0x1000415a
cmp dword [0x10077b04], 0xcd790ae
jne 0x1000412d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [ebp - 0x70], eax
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push str.r86IKtQdU8uTw3Gyq2
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
push 0
push str.6QFqeFPQ4wYwZ4su2
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeInitializeW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollBarInfo]
push 0
call dword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropW]
call dword [sym.imp.USER32.dll_IsProcessDPIAware]
push 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_CharToOemW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
push 0
push 0
push 0
push 0
push 0
push str.Xcmak76TP1RYhnipybrBb3Z34z3n
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
call dword [sym.imp.USER32.dll_GetGuiResources]
push 0
call dword [sym.imp.USER32.dll_SetCapture]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
push str.82fDk5bCt7ZG78sjxlSUBpZ
push 0
push 0
push str.A3bS14LtGUDRwiAqWg4uM8O
push 0
push 0
push str.7HzaCBSWd1VTi6Yo82wjqg
call dword [sym.imp.KERNEL32.dll_GetDateFormatEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PrivateExtractIconsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push 0
push 0
call dword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReOpenFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push 0
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
push 0
push str.YErTu6bdsd6Gj3nmrC5w6N7vFC6D
push str.JQoQEpO54cndzuZA
push 0
call dword [sym.imp.USER32.dll_CharPrevExA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
push 0
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DlgDirListW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov eax, dword [ebp - 0x34]
shr eax, 8
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
xor edx, dword [ebp - 0x34]
and edx, 0xff
xor eax, dword [ebp + edx*4 - 0x470]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x10003e7b
mov eax, dword [ebp - 0x34]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8