Function at 0x4119ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x5f0
mov eax, 0x518aa0
call fcn.004e643a
mov esi, ecx
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x164], esi
xor ebx, ebx
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [esi + 0x7b4]
mov al, 1
xchg byte [ecx], al
lea ecx, [esi + 0x800]
mov eax, dword [ecx]
add eax, eax
xchg dword [ecx], eax
mov dword [ebp - 4], ebx
wait
push ecx
lea ecx, [ebp - 0x154]
call fcn.00428c44
pop ecx
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
mov byte [ebp - 4], 2
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movsd qword [ebp - 0x50], xmm0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x411a9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x14c]
push eax
push 0x549b30
push 0x17
push ebx
push 0x537748
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x411af7
push dword [ebp - 0x14c]
call dword [sym.imp.ole32.dll_OleRun]
mov esi, eax
test esi, esi
js 0x411ae2
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x549bd4
push ecx
call dword [eax]
mov esi, eax
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
js 0x411af7
mov eax, dword [ebp - 0x18]
jmp 0x411afc
mov eax, ebx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4124bc
mov ecx, dword [eax]
push ebx
push ecx
push ecx
movsd xmm0, qword [ebp - 0x50]
movsd qword [esp], xmm0
push eax
call dword [ecx + 0xb0]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4124bc
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
mov dword [ebp - 0x150], edi
push 0xc
call fcn.004e5464
pop ecx
mov ecx, eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x168], ecx
mov byte [ebp - 4], 5
test ecx, ecx
je 0x411b73
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 1
mov dword [ecx], ebx
mov edi, dword [ebp - 0x150]
jmp 0x411b7b
mov ecx, ebx
mov dword [ebp - 0x14c], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x4125a2
push ecx
push esi
call edi
mov eax, dword [ebp - 0x14c]
push dword [eax]
lea ecx, [ebp - 0x78]
call fcn.0041efa2
mov byte [ebp - 4], 6
push 0x98
push ebx
lea eax, [ebp - 0x148]
push eax
call fcn.004e7ca0
pop ecx
pop ecx
lea ecx, [ebp - 0x148]
call fcn.0041d738
mov byte [ebp - 4], 7
push str._AND_TimeGenerated___
push str._AND__EventCode__1000_OR_EventCode__1002_OR_EventCode__1026_
push str._AND_EventType___3
push str._WHERE_Logfile__Application
push str.Win32_NTLogEvent
lea eax, [ebp - 0x148]
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
mov esi, eax
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x4bc]
call fcn.00409ce9
mov byte [ebp - 4], 8
push 0x5458f0
push 0x570bb0
push str._AND_Message_LIKE__
push 0x54590c
push eax
push esi
call fcn.00427b6a
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
push eax
call fcn.00427b6a
pop ecx
pop ecx
push eax
call fcn.00427450
pop ecx
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4bc]
call fcn.00421eb9
lea eax, [ebp - 0x4d4]
push eax
lea ecx, [ebp - 0x148]
call fcn.0041d5a5
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x48]
call fcn.0041f2ac
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4d4]
call fcn.00421eb9
lea ecx, [ebp - 0xb0]
call fcn.0040c311
mov byte [ebp - 4], 0xa
mov edi, dword [ebp - 0x158]
mov eax, dword [edi + 0x7fc]
mov dword [ebp - 0x150], eax
mov edx, eax
lea ecx, [ebp - 0x4a4]
call fcn.00406ec6
mov byte [ebp - 4], 0xb
push eax
push 0x5450fc
lea ecx, [ebp - 0x3cc]
call fcn.004281b4
mov byte [ebp - 4], 0xc
mov edx, dword [0x570bf8]
lea ecx, [ebp - 0x42c]
call fcn.00406ec6
mov byte [ebp - 4], 0xd
push eax
push ecx
lea ecx, [ebp - 0x39c]
call fcn.004281ea
mov byte [ebp - 4], 0xe
push ecx
push ecx
lea ecx, [ebp - 0x36c]
call fcn.00428222
mov byte [ebp - 4], 0xf
call fcn.0040c193
mov esi, 0x5459bc
mov ecx, 0x5459c0
test al, al
cmove esi, ecx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], 0xf
mov byte [ebp - 0x33c], bl
push 4
push str.init
lea ecx, [ebp - 0x33c]
call fcn.0041f19e
mov byte [ebp - 4], 0x10
push esi
lea ecx, [ebp - 0x324]
call fcn.0041f318
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov eax, dword [edi + 0x800]
mov dword [ebp - 0x150], eax
mov edx, eax
lea ecx, [ebp - 0x414]
call fcn.00406ec6
mov esi, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f8], ebx
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f8], 0xf
mov byte [ebp - 0x30c], bl
push 7
push str.success
lea ecx, [ebp - 0x30c]
call fcn.0041f19e
mov byte [ebp - 4], 0x14
push esi
lea ecx, [ebp - 0x2f4]
call fcn.0041f2ce
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x3fc]
call fcn.00406ec6
mov esi, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], 0xf
mov byte [ebp - 0x2dc], bl
push 0xd
push str.server_report
lea ecx, [ebp - 0x2dc]
call fcn.0041f19e
mov byte [ebp - 4], 0x18
push esi
lea ecx, [ebp - 0x2c4]
call fcn.0041f2ce
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x80]
lea ecx, [ebp - 0x3e4]
call fcn.00406ec6
mov esi, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], 0xf
mov byte [ebp - 0x2ac], bl
push 0xa
push str.server_new
lea ecx, [ebp - 0x2ac]
call fcn.0041f19e
mov byte [ebp - 4], 0x1c
push esi
lea ecx, [ebp - 0x294]
call fcn.0041f2ce
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
push 0xf
pop eax
mov dword [ebp - 0x268], eax
mov byte [ebp - 0x27c], bl
push eax
push str.server_hash_old
lea ecx, [ebp - 0x27c]
call fcn.0041f19e
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x264]
call fcn.004221f8
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
push 0xf
pop eax
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x24c], bl
push eax
push str.server_hash_new
lea ecx, [ebp - 0x24c]
call fcn.0041f19e
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x234]
call fcn.004221f8
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3cc]
mov dword [ebp - 0x16c], ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x168], eax
push eax
push ecx
lea ecx, [ebp - 0x1d4]
call fcn.0041cfcd
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x1d4]
push eax
mov ecx, edi
call fcn.0041b2fa
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1d4]
call fcn.0041d05b
mov byte [ebp - 4], 0x27
push fcn.0040a1ca
push 9
push 0x30
lea eax, [ebp - 0x3cc]
push eax
call fcn.004e5494
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x3e4]
call fcn.00421eb9
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3fc]
call fcn.00421eb9
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x414]
call fcn.00421eb9
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x42c]
call fcn.00421eb9
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x4a4]
call fcn.00421eb9
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push str.SourceName
lea ecx, [ebp - 0x54c]
call fcn.0040a0ed
mov byte [ebp - 4], 0x2b
push ebx
push str.InsertionStrings
lea ecx, [ebp - 0x51c]
call fcn.0040a0ed
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x1dc], eax
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x1d8], eax
lea eax, [ebp - 0x1dc]
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.0040a4f9
mov byte [ebp - 4], 0x2e
mov dword [esp], fcn.0040a1ca
push 2
push 0x30
lea eax, [ebp - 0x54c]
push eax
call fcn.004e5494
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
cmp esi, edi
je 0x4123b4
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x14c], edi
cmp esi, edi
je 0x4123b4
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.0042a2bb
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x30
cmp dword [ebp - 0x20], 0
je 0x412396
mov edi, dword [ebp - 0x158]
mov eax, dword [edi + 0x7fc]
mov dword [ebp - 0x150], eax
mov edx, eax
lea ecx, [ebp - 0x444]
call fcn.00406ec6
mov esi, eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], bl
push 4
push 0x5450fc
lea ecx, [ebp - 0x19c]
call fcn.0041f19e
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042a22c
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0041f2ac
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x188]
cmp eax, 0x10
jb 0x412162
inc eax
push eax
push dword [ebp - 0x19c]
call fcn.0042ca26
pop ecx
pop ecx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], bl
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x444]
call fcn.00421eb9
mov edx, dword [0x570bf8]
lea ecx, [ebp - 0x45c]
call fcn.00406ec6
mov esi, eax
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], bl
push 5
push str.appid
lea ecx, [ebp - 0x184]
call fcn.0041f19e
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042a22c
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0041f2ac
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0x170]
cmp eax, 0x10
jb 0x412215
inc eax
push eax
push dword [ebp - 0x184]
call fcn.0042ca26
pop ecx
pop ecx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], bl
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x45c]
call fcn.00421eb9
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], bl
push 3
push 0x54510c
lea ecx, [ebp - 0x1b4]
call fcn.0041f19e
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042a22c
push 0x570c74
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0041f27f
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x1a0]
cmp eax, 0x10
jb 0x4122b5
inc eax
push eax
push dword [ebp - 0x1b4]
call fcn.0042ca26
pop ecx
pop ecx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], bl
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x30]
sar edx, 3
lea ecx, [ebp - 0x474]
call fcn.00406f2c
mov esi, eax
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1bc], ebx
push 0xf
pop eax
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 0x1cc], bl
push eax
push str.event_log_error
lea ecx, [ebp - 0x1cc]
call fcn.0041f19e
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042a22c
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0041f2ac
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x1b8]
cmp eax, 0x10
jb 0x41235a
inc eax
push eax
push dword [ebp - 0x1cc]
call fcn.0042ca26
pop ecx
pop ecx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], bl
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x474]
call fcn.00421eb9
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0041b2fa
mov esi, dword [ebp - 0x15c]
mov edi, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x24]
call fcn.0041d05b
add esi, 8
mov dword [ebp - 0x15c], esi
jmp 0x41209a
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x412403
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x160], esi
cmp esi, edi
je 0x4123e0
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.0041d05b
add esi, 8
jmp 0x4123c2
lea esi, [ebp - 0x28]
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
sub eax, dword [ecx]
and eax, 0xfffffff8
push eax
push dword [ecx]
call fcn.0042ca26
pop ecx
pop ecx
lea eax, [ebp - 0x30]
mov dword [eax], ebx
lea eax, [ebp - 0x2c]
mov dword [eax], ebx
mov dword [esi], ebx
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb0]
call fcn.0040c7e4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x148]
call fcn.0040999f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x78]
call fcn.00421c43
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x412465
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
mov dword [ebp - 0x168], eax
jne 0x412462
mov ecx, esi
call fcn.004081fa
push 0xc
push esi
call fcn.004e581d
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x412476
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x41248e
inc eax
push eax
push dword [ebp - 0x48]
call fcn.0042ca26
pop ecx
pop ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
mov byte [ebp - 4], bl
cmp byte [ebp - 0x153], 0
je 0x4124ac
call fcn.004125ad
wait
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x158]
jmp 0x412594
push 0x80004003
jmp 0x4125a7
push ebx
mov ecx, eax
call fcn.0044999b
call fcn.004e6387
ret
push 0x8007000e
call fcn.004e4f50
int3