Function at 0x413200
Capabilities:
Allocate thread local storage
Enumerate files on windows
Get file size
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov dword [ebp - 0x20], 0xff
mov dword [ebp - 0x3c], 0xad
mov dword [ebp - 0x18], 0xdf
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0xb8
jmp 0x413193
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xc3
jae 0x413406
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x164], 0xf4
mov dword [ebp - 0x78], 0
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x5c], 0xf0
ja case.0x4131eb.1
mov eax, dword [ebp - 0x5c]
movzx ecx, byte [eax + 0x414238]
jmp dword [ecx*4 + 0x414224]
mov edx, dword [ebp - 0x60]
xor edx, dword [ebp - 0x40]
mov dword [ebp - 0x194], edx
jmp 0x41326f
mov dword [ebp - 0x198], 0x40
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x19c], eax
jmp 0x41326f
mov dword [ebp - 0x1a0], 0x1e
mov dword [ebp - 0x1a4], 0x91
mov eax, dword [0x421824]
xor edx, edx
div dword [0x4217e8]
mov dword [ebp - 0x60], eax
jmp 0x41326f
mov dword [ebp - 0x1a8], 0x15
mov dword [ebp - 0x44], 0x51
mov eax, dword [ebp - 0x44]
xor edx, edx
div dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
jmp 0x41326f
mov ecx, dword [ebp - 0x34]
xor ecx, dword [ebp - 0x1ac]
mov dword [0x4217ec], ecx
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x34]
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x20]
add eax, dword [0x421804]
mov ecx, dword [0x4217ec]
sub ecx, dword [ebp - 0x30]
cmp eax, ecx
je 0x413297
mov dword [ebp - 0x64], 1
jmp 0x41329e
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0
jne 0x4132d8
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x24]
mov eax, dword [0x4217e4]
or eax, dword [0x4217e8]
cmp edx, eax
jne 0x4132c2
mov dword [ebp - 0x68], 1
jmp 0x4132c9
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
jne 0x4132d8
mov dword [ebp - 0x6c], 0
jmp 0x4132df
mov dword [ebp - 0x6c], 1
cmp dword [ebp - 0x6c], 0
jne 0x41331d
mov ecx, dword [0x4217f0]
and ecx, dword [0x421818]
je 0x413307
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x18]
test edx, edx
je 0x413307
mov dword [ebp - 0x70], 1
jmp 0x41330e
mov dword [ebp - 0x70], 0
cmp dword [ebp - 0x70], 0
jne 0x41331d
mov dword [ebp - 0x74], 0
jmp 0x413324
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x74], 0
jne 0x413356
mov eax, dword [ebp - 0x34]
xor eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x164]
or ecx, dword [ebp - 0x84]
cmp eax, ecx
je 0x413349
mov dword [ebp - 0x7c], 1
jmp 0x413350
mov dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 0
je 0x4133ba
mov dword [ebp - 0x1b0], 0x3d
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x168], 0xb5
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x174], 0
mov edx, dword [ebp - 0x80]
imul edx, dword [ebp - 0x168]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x16c]
xor eax, dword [ebp - 0x170]
mov dword [ebp - 0x174], eax
jmp 0x413401
mov dword [ebp - 0x1b8], 0xd9
mov dword [ebp - 0x1bc], 0x8f
mov ecx, dword [ebp - 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [ebp + 0xc], eax
mov edx, dword [0x421800]
push edx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x178], eax
jmp 0x41318a
mov ecx, dword [0x4217ec]
add ecx, dword [0x421814]
mov edx, dword [0x421814]
imul edx, dword [0x421818]
cmp ecx, edx
jae 0x41342f
mov dword [ebp - 0x88], 1
jmp 0x413439
mov dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0
je 0x4135c3
mov eax, dword [ebp - 4]
or eax, dword [ebp - 8]
jne 0x413462
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
jne 0x413462
mov dword [ebp - 0x8c], 0
jmp 0x41346c
mov dword [ebp - 0x8c], 1
cmp dword [ebp - 0x8c], 0
je 0x4135c3
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [0x4217e0]
imul ecx, dword [0x421820]
cmp eax, ecx
je 0x4134a0
mov dword [ebp - 0x90], 1
jmp 0x4134aa
mov dword [ebp - 0x90], 0
mov edx, dword [0x421814]
and edx, dword [0x4217fc]
jne 0x4134d5
mov eax, dword [0x421800]
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jne 0x4134d5
mov dword [ebp - 0x94], 0
jmp 0x4134df
mov dword [ebp - 0x94], 1
mov edx, dword [ebp - 0x90]
cmp edx, dword [ebp - 0x94]
jne 0x4134f9
mov dword [ebp - 0x98], 1
jmp 0x413503
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0
je 0x413589
mov eax, dword [0x421824]
add eax, dword [0x4217f4]
mov dword [0x421820], eax
mov ecx, dword [0x4217f8]
sub ecx, dword [ebp - 0x18]
mov dword [0x421814], ecx
mov edx, dword [0x421820]
cmp edx, dword [0x421814]
jne 0x413545
mov dword [ebp - 0x9c], 1
jmp 0x41354f
mov dword [ebp - 0x9c], 0
cmp dword [ebp - 0x9c], 0
je 0x413589
mov eax, dword [0x421814]
or eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov ecx, dword [0x4217f8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [0x4217ec]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x421808], eax
jmp 0x41359f
mov dword [ebp - 0x1c0], 0xf9
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x20]
xor edx, edx
div dword [str.AJ]
mov dword [0x421800], eax
mov eax, dword [ebp + 8]
imul eax, dword [0x42180c]
mov dword [str.AJ], eax
jmp 0x4137e0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x1c4], 0
mov ecx, dword [ebp - 0x38]
and ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
push str.bqqevo.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
mov dword [ebp - 0x38], eax
push str.XaBWpkWcHn
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x20]
xor edx, dword [0x4217f8]
jne 0x41364a
mov eax, dword [0x421820]
xor eax, dword [ebp - 0xc]
jne 0x41364a
mov dword [ebp - 0xa0], 0
jmp 0x413654
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0xa0], 0
je 0x4136a1
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x3c]
test ecx, ecx
jne 0x413682
mov edx, dword [0x4217fc]
xor edx, dword [0x4217f4]
jne 0x413682
mov dword [ebp - 0xa4], 0
jmp 0x41368c
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xa4], 0
je 0x4136a1
mov dword [ebp - 0xa8], 1
jmp 0x4136ab
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0
je 0x4136f4
mov eax, dword [0x4217f8]
and eax, dword [ebp - 0x10]
mov ecx, dword [0x4217f4]
and ecx, dword [ebp + 0xc]
cmp eax, ecx
jne 0x4136d5
mov dword [ebp - 0xac], 1
jmp 0x4136df
mov dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0
je 0x4136f4
mov dword [ebp - 0xb0], 1
jmp 0x4136fe
mov dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0
je 0x413784
mov edx, dword [ebp - 0xb8]
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x38]
cmp edx, eax
jae 0x413728
mov dword [ebp - 0xb4], 1
jmp 0x413732
mov dword [ebp - 0xb4], 0
cmp dword [ebp - 0xb4], 0
je 0x413784
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [0x421820]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x4217ec]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x4c], eax
mov edx, dword [0x421820]
push edx
mov eax, dword [0x4217f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x421814], eax
jmp 0x4137bb
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1d0], 0xdc
mov dword [ebp - 0x1d4], 0
mov edx, dword [0x421820]
push edx
call fcn.00410de4
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 8], eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x1c]
je 0x413802
mov edx, dword [str.AJ]
or edx, dword [0x4217e0]
je 0x413802
mov dword [ebp - 0xbc], 1
jmp 0x41380c
mov dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0
je 0x413856
mov eax, dword [0x421818]
imul eax, dword [0x4217fc]
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 4]
cmp eax, ecx
jbe 0x413837
mov dword [ebp - 0xc0], 1
jmp 0x413841
mov dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0
je 0x413856
mov dword [ebp - 0xc4], 1
jmp 0x413860
mov dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0
je 0x4138a9
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 4]
mov eax, dword [0x4217e4]
or eax, dword [0x4217e8]
cmp edx, eax
je 0x41388a
mov dword [ebp - 0xc8], 1
jmp 0x413894
mov dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0
je 0x4138a9
mov dword [ebp - 0xcc], 1
jmp 0x4138b3
mov dword [ebp - 0xcc], 0
cmp dword [ebp - 0xcc], 0
je 0x4138fa
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x10]
jne 0x4138db
mov edx, dword [0x4217ec]
xor edx, dword [ebp - 0x1c]
jne 0x4138db
mov dword [ebp - 0xd0], 0
jmp 0x4138e5
mov dword [ebp - 0xd0], 1
cmp dword [ebp - 0xd0], 0
je 0x4138fa
mov dword [ebp - 0xd4], 1
jmp 0x413904
mov dword [ebp - 0xd4], 0
cmp dword [ebp - 0xd4], 0
je 0x413940
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 4]
jne 0x413929
mov ecx, dword [ebp - 8]
or ecx, dword [ebp - 4]
jne 0x413929
mov dword [ebp - 0xd8], 0
jmp 0x413933
mov dword [ebp - 0xd8], 1
cmp dword [ebp - 0xd8], 0
jne 0x413c2d
mov dword [ebp - 0xf4], 0xcf
mov dword [ebp - 0x1d8], 0xc9
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1e0], 0
mov edx, dword [0x42181c]
sub edx, dword [0x4217e8]
mov eax, dword [ebp - 0xf4]
or eax, dword [0x4217f8]
cmp edx, eax
jne 0x413997
mov dword [ebp - 0xdc], 1
jmp 0x4139a1
mov dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0
je 0x4139eb
mov ecx, dword [0x421804]
xor ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4217e4]
cmp ecx, edx
jae 0x4139cc
mov dword [ebp - 0xe0], 1
jmp 0x4139d6
mov dword [ebp - 0xe0], 0
cmp dword [ebp - 0xe0], 0
je 0x4139eb
mov dword [ebp - 0xe4], 1
jmp 0x4139f5
mov dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 0
je 0x413a48
mov eax, dword [ebp - 0x10]
imul eax, dword [0x42180c]
test eax, eax
jne 0x413a29
mov ecx, dword [0x4217f0]
imul ecx, dword [0x4217f4]
test ecx, ecx
jne 0x413a29
mov dword [ebp - 0xe8], 0
jmp 0x413a33
mov dword [ebp - 0xe8], 1
cmp dword [ebp - 0xe8], 0
je 0x413a48
mov dword [ebp - 0xec], 1
jmp 0x413a52
mov dword [ebp - 0xec], 0
cmp dword [ebp - 0xec], 0
je 0x413ad1
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
and eax, dword [ebp - 0x28]
cmp edx, eax
jae 0x413a77
mov dword [ebp - 0xf0], 1
jmp 0x413a81
mov dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0
je 0x413ad1
mov dword [ebp - 0x180], 0xd2
mov ecx, dword [ebp - 0x180]
push ecx
mov edx, dword [0x421818]
push edx
mov eax, dword [0x4217f4]
push eax
call dword [sym.imp.GDI32.dll_PolylineTo]
mov dword [ebp - 0xf4], eax
mov eax, dword [0x421804]
xor edx, edx
div dword [ebp - 0x1e4]
mov dword [0x421804], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp + 0xc], eax
jmp 0x413b3d
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xf8], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x413b09
mov dword [ebp - 0x50], 0x25a7
push 0
push 0xffffffffffffffff
push str.dzzxk
push 0xffffffffffffffff
push str.mdjpavlfxfp
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0xf8], eax
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0xf8], edx
jmp 0x413c2d
mov eax, dword [ebp - 0xc]
sub eax, dword [0x421804]
je 0x413b6f
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [0x4217f8]
push edx
mov eax, dword [0x4217e8]
push eax
call dword [sym.imp.GDI32.dll_PolylineTo]
test eax, eax
je 0x413b6f
mov dword [ebp - 0xfc], 1
jmp 0x413b79
mov dword [ebp - 0xfc], 0
cmp dword [ebp - 0xfc], 0
jne 0x413bbb
mov esi, dword [ebp - 4]
xor esi, dword [0x421804]
mov ecx, dword [0x421804]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp esi, eax
jne 0x413ba8
mov dword [ebp - 0x100], 1
jmp 0x413bb2
mov dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0
je 0x413be4
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x421804], eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp - 0x28]
mov dword [0x421820], eax
mov ecx, dword [ebp + 8]
add ecx, dword [str.AJ]
mov dword [ebp + 8], ecx
jmp 0x413c16
mov dword [ebp - 0x1e8], 0xca
mov edx, dword [0x4217f8]
push edx
mov eax, dword [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x421820], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x4217fc]
mov dword [0x42181c], ecx
mov edx, dword [0x4217f0]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4217e4], eax
jmp 0x4137e0
cmp dword [ebp - 0x18], 0
je 0x413c3a
mov dword [ebp - 4], 0x2703
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
xor edx, dword [0x4217e8]
jne 0x413c62
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0xc]
jne 0x413c62
mov dword [ebp - 0x104], 0
jmp 0x413c6c
mov dword [ebp - 0x104], 1
cmp dword [ebp - 0x104], 0
jne 0x413cb6
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x421804]
mov edx, dword [0x4217e0]
or edx, dword [ebp - 4]
cmp ecx, edx
jae 0x413c97
mov dword [ebp - 0x108], 1
jmp 0x413ca1
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x108], 0
jne 0x413cb6
mov dword [ebp - 0x10c], 0
jmp 0x413cc0
mov dword [ebp - 0x10c], 1
cmp dword [ebp - 0x10c], 0
jne 0x413d0a
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
mov ecx, dword [0x421800]
xor ecx, dword [0x4217f4]
cmp eax, ecx
jne 0x413ceb
mov dword [ebp - 0x110], 1
jmp 0x413cf5
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
jne 0x413d0a
mov dword [ebp - 0x114], 0
jmp 0x413d14
mov dword [ebp - 0x114], 1
cmp dword [ebp - 0x114], 0
jne 0x413d50
mov edx, dword [ebp - 8]
or edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
or eax, dword [ebp - 8]
cmp edx, eax
jae 0x413d39
mov dword [ebp - 0x118], 1
jmp 0x413d43
mov dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0
je 0x414200
mov dword [ebp - 0x130], 0xe7
mov dword [ebp - 0x58], 0x46
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [0x4217e0]
add ecx, dword [0x4217fc]
jne 0x413d94
mov edx, dword [ebp - 0x18]
sub edx, dword [0x4217f8]
jne 0x413d94
mov dword [ebp - 0x11c], 0
jmp 0x413d9e
mov dword [ebp - 0x11c], 1
cmp dword [ebp - 0x11c], 0
jne 0x413de5
mov eax, dword [ebp + 0xc]
and eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
and ecx, dword [0x4217e0]
cmp eax, ecx
jae 0x413dc6
mov dword [ebp - 0x120], 1
jmp 0x413dd0
mov dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0
jne 0x413de5
mov dword [ebp - 0x124], 0
jmp 0x413def
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x124], 0
jne 0x413e2c
mov edx, dword [ebp - 0x2c]
xor edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x2c]
cmp edx, eax
jne 0x413e15
mov dword [ebp - 0x128], 1
jmp 0x413e1f
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0
je 0x413f36
mov dword [ebp - 0x138], 0xeb
mov dword [ebp - 0x12c], 0x7d
mov dword [ebp - 0x13c], 0xea
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x58]
push ecx
push str.fSjOEJbpJn
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x130], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x12c]
movzx eax, word [edx]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x413eb4
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x413e94
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x13c]
mov dword [ebp - 0x134], edx
lea eax, [ebp - 0x138]
push eax
push str.SuUVhDDbV
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x184]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x413f0b
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x413ee8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x54], ecx
push 0
push 0xffffffffffffffff
push str.bezvaeel
push 0xffffffffffffffff
push str.mzcuxysedga
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x13c], eax
jmp 0x413f5e
mov dword [ebp - 0x1f0], 0x81
mov edx, dword [0x42180c]
and edx, dword [ebp + 8]
mov dword [0x42180c], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x421804], eax
push 0
push 0xffffffffffffffff
push str.ueprg
push 0xffffffffffffffff
push str.zmtui
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x14], eax
push 0
push 0xffffffffffffffff
push str.kyxfeh
push 0xffffffffffffffff
push str.ytplz
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x2c], eax
push 0
push 0xffffffffffffffff
push str.vyeixge
push 0xffffffffffffffff
push str.eupbrn
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x2c], eax
push 0
push 0xffffffffffffffff
push str.gwbfims
push 0xffffffffffffffff
push str.dqwqsaek
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x4217ec]
imul ecx, dword [0x421814]
mov edx, dword [ebp - 0x24]
sub edx, dword [0x4217fc]
cmp ecx, edx
je 0x414004
mov dword [ebp - 0x140], 1
jmp 0x41400e
mov dword [ebp - 0x140], 0
cmp dword [ebp - 0x140], 0
je 0x414058
mov eax, dword [ebp + 8]
and eax, dword [ebp - 0x58]
mov ecx, dword [0x4217fc]
xor ecx, dword [0x4217f4]
cmp eax, ecx
jae 0x414039
mov dword [ebp - 0x144], 1
jmp 0x414043
mov dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0
je 0x414058
mov dword [ebp - 0x148], 1
jmp 0x414062
mov dword [ebp - 0x148], 0
cmp dword [ebp - 0x148], 0
je 0x4140ab
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp + 8]
mov eax, dword [0x42180c]
xor eax, dword [0x4217e0]
cmp edx, eax
jbe 0x41408c
mov dword [ebp - 0x14c], 1
jmp 0x414096
mov dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 0
je 0x4140ab
mov dword [ebp - 0x150], 1
jmp 0x4140b5
mov dword [ebp - 0x150], 0
cmp dword [ebp - 0x150], 0
je 0x4140ff
mov ecx, dword [0x421800]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0xc]
add edx, dword [0x421814]
cmp ecx, edx
jbe 0x4140e0
mov dword [ebp - 0x154], 1
jmp 0x4140ea
mov dword [ebp - 0x154], 0
cmp dword [ebp - 0x154], 0
je 0x4140ff
mov dword [ebp - 0x158], 1
jmp 0x414109
mov dword [ebp - 0x158], 0
cmp dword [ebp - 0x158], 0
je 0x414168
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x14]
cmp eax, ecx
jae 0x41412e
mov dword [ebp - 0x15c], 1
jmp 0x414138
mov dword [ebp - 0x15c], 0
cmp dword [ebp - 0x15c], 0
je 0x414168
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [0x421818]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4217f4], eax
jmp 0x4141fe
mov dword [ebp - 0x160], 0xf3
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1fc], 0x7f
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x204], 0xdd
mov dword [ebp - 0x18c], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
mov edx, dword [ebp - 0x188]
movzx eax, word [edx]
mov dword [ebp - 0x18c], eax
push str.isgUkcxaHTN.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x160], eax
push str.IpXgfcTeMR
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x190], eax
jmp 0x414219
mov dword [ebp - 0x208], 0x92
mov edx, dword [ebp - 0x1c]
and edx, dword [0x421804]
mov dword [0x4217f0], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret